[XMLRPC-145] Paranoid mode of class Webserver doesn't work any more since v3.0

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0a1, 3.0b1, 3.0rc1, 3.0, 3.1
• Fix Version/s: 3.1
• Component/s: Source
• Environment: Using Java 1.5 and XMLRPC v3.0 and above
• Assignee: Jochen Wiedmann
• Reporter: Gamaliel Amaudruz
• Created: 01/Aug/07 12:15
• Updated: 28/Nov/08 20:53
• Resolved: 01/Aug/07 20:54

Description

If you activate the paranoid mode of class WebServer since version 3.0, it rejects all connections because of the following bug in constructor of private class AddressMatcher:
line ~89 of head revision of class WebServer:
pattern[i] = Integer.parseInt(next);
should be rolled back to:
pattern[i] = (byte) Integer.parseInt(next);
as in version 2.0
Without the casting, the IP pattern is not correctly recorded and therefore all supposed accepted IPs are denied...

It's a major bug of v3.0 to me.