8285662: Better permission resolution

Reviewed-by: mbalao, andrew
Backport-of: 18c17a1391aaa67c71da13f034674fc294c25d5a

Author: Aleksei Voitylov

jdk/src/share/classes/java/security/UnresolvedPermission.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -151,7 +151,7 @@ public final class UnresolvedPermission extends Permission
      * Each chain is ordered bottom-to-top (i.e., with the signer certificate
      * first and the (root) certificate authority last). The signer
      * certificates are copied from the array. Subsequent changes to
-     * the array will not affect this UnsolvedPermission.
+     * the array will not affect this UnresolvedPermission.
      */
     public UnresolvedPermission(String type,
                                 String name,
@@ -163,59 +163,63 @@ public UnresolvedPermission(String type,
         if (type == null)
                 throw new NullPointerException("type can't be null");
 
+        // Perform a defensive copy and reassign certs if we have a non-null
+        // reference
+        if (certs != null) {
+            certs = certs.clone();
+        }
+
         this.type = type;
         this.name = name;
         this.actions = actions;
+
         if (certs != null) {
             // Extract the signer certs from the list of certificates.
-            for (int i=0; i<certs.length; i++) {
+            for (int i = 0; i < certs.length; i++) {
                 if (!(certs[i] instanceof X509Certificate)) {
                     // there is no concept of signer certs, so we store the
-                    // entire cert array
-                    this.certs = certs.clone();
-                    break;
+                    // entire cert array.  No further processing is necessary.
+                    this.certs = certs;
+                    return;
                 }
             }
 
-            if (this.certs == null) {
-                // Go through the list of certs and see if all the certs are
-                // signer certs.
-                int i = 0;
-                int count = 0;
-                while (i < certs.length) {
-                    count++;
-                    while (((i+1) < certs.length) &&
-                           ((X509Certificate)certs[i]).getIssuerDN().equals(
-                               ((X509Certificate)certs[i+1]).getSubjectDN())) {
-                        i++;
-                    }
+            // Go through the list of certs and see if all the certs are
+            // signer certs.
+            int i = 0;
+            int count = 0;
+            while (i < certs.length) {
+                count++;
+                while (((i + 1) < certs.length) &&
+                       ((X509Certificate)certs[i]).getIssuerDN().equals(
+                           ((X509Certificate)certs[i + 1]).getSubjectDN())) {
                     i++;
                 }
-                if (count == certs.length) {
-                    // All the certs are signer certs, so we store the entire
-                    // array
-                    this.certs = certs.clone();
-                }
+                i++;
+            }
+            if (count == certs.length) {
+                // All the certs are signer certs, so we store the entire
+                // array.  No further processing is needed.
+                this.certs = certs;
+                return;
+            }
 
-                if (this.certs == null) {
-                    // extract the signer certs
-                    ArrayList<java.security.cert.Certificate> signerCerts =
-                        new ArrayList<>();
-                    i = 0;
-                    while (i < certs.length) {
-                        signerCerts.add(certs[i]);
-                        while (((i+1) < certs.length) &&
-                            ((X509Certificate)certs[i]).getIssuerDN().equals(
-                              ((X509Certificate)certs[i+1]).getSubjectDN())) {
-                            i++;
-                        }
-                        i++;
-                    }
-                    this.certs =
-                        new java.security.cert.Certificate[signerCerts.size()];
-                    signerCerts.toArray(this.certs);
+            // extract the signer certs
+            ArrayList<java.security.cert.Certificate> signerCerts =
+                new ArrayList<>();
+            i = 0;
+            while (i < certs.length) {
+                signerCerts.add(certs[i]);
+                while (((i + 1) < certs.length) &&
+                    ((X509Certificate)certs[i]).getIssuerDN().equals(
+                      ((X509Certificate)certs[i + 1]).getSubjectDN())) {
+                    i++;
                 }
+                i++;
             }
+            this.certs =
+                new java.security.cert.Certificate[signerCerts.size()];
+            signerCerts.toArray(this.certs);
         }
     }
 
@@ -308,6 +312,7 @@ Permission resolve(Permission p, java.security.cert.Certificate certs[]) {
      *
      * @return false.
      */
+    @Override
     public boolean implies(Permission p) {
         return false;
     }
@@ -328,6 +333,7 @@ public boolean implies(Permission p) {
      * type (class) name, permission name, actions, and
      * certificates as this object.
      */
+    @Override
     public boolean equals(Object obj) {
         if (obj == this)
             return true;
@@ -401,7 +407,7 @@ public boolean equals(Object obj) {
      *
      * @return a hash code value for this object.
      */
-
+    @Override
     public int hashCode() {
         int hash = type.hashCode();
         if (name != null)
@@ -421,6 +427,7 @@ public int hashCode() {
      *
      * @return the empty string "".
      */
+    @Override
     public String getActions()
     {
         return "";
@@ -488,6 +495,7 @@ public java.security.cert.Certificate[] getUnresolvedCerts() {
      *
      * @return information about this UnresolvedPermission.
      */
+    @Override
     public String toString() {
         return "(unresolved " + type + " " + name + " " + actions + ")";
     }
@@ -499,7 +507,7 @@ public String toString() {
      * @return a new PermissionCollection object suitable for
      * storing UnresolvedPermissions.
      */
-
+    @Override
     public PermissionCollection newPermissionCollection() {
         return new UnresolvedPermissionCollection();
     }