[#JRA-10601] XML-RPC to fix/improve String casting

JIRA

XML-RPC to fix/improve String casting

Created: 13/Jul/06 11:46 AM Updated: 04/Nov/07 09:59 PM

Component/s:

Remote API (SOAP & XML-RPC)

Affects Version/s:

None

Fix Version/s:

3.6.4

Time Tracking:

Original Estimate:

Not Specified

Remaining Estimate:

0 minutes

Time Spent:

1 hour

File Attachments:

com.atlassian.jira.rpc.xmlrpc.tar.gz (7 kB)

Issue Links:

Reference

This issue is related to:

CONF-9880 RPC storePage parentId should handle string type

Participants:	Dushan Hanuska [Atlassian], Jeff Turner [Atlassian], Ted Pietrzak and Yuen-Chi Lian [Atlassian]
Since last comment:	1 year, 48 weeks, 3 days ago
Resolution Date:	21/Jul/06 01:11 AM
Labels:

Description

« Hide

The current XML-RPC (JiraXmlRpcService) does not do type-checking before casting an Object to String, e.g.

private RemoteCustomFieldValue makeCustomFieldValue(Hashtable struct) throws IllegalAccessException, InvocationTargetException
{
  RemoteCustomFieldValue customFieldValue = new RemoteCustomFieldValue();
  customFieldValue.setCustomfieldId((String) struct.get("customfieldId"));
  customFieldValue.setKey((String) struct.get("key"));
  customFieldValue.setValues(makeStringVector((Vector) struct.get("values")));
  return customFieldValue;
}

private String[] makeStringVector(Vector vector)
{
  final String[] strings = new String[vector.size()];
  int i = 0;
  for (Iterator iterator = vector.iterator(); iterator.hasNext();)
  {
    Object j = iterator.next();
    strings[i] = (String) j;
    i++;
  }
  return strings;
}

This should not be a problem, however, say, if a client is using Perl's XMLRPC::Lite, a string-type integer will be converted to and sent as integer-type, e.g.

...
<name>customFieldValues</name>
  <value>
    <array>
      <data>
        <value>
        <value>
          <struct>
            <member>
              <name>customfieldId</name>
              <value>
                <string>customfield_10100</string>
              </value>
            </member>
            <member>
              <name>values</name>
              <value>
                <array>
                  <data>
                    <value>
                      <int>10194</int>
                    </value>
                  </data>
                </array>
              </value>
            </member>
            <member>
              <name>key</name>
              <value>
                <int>1</int>
              </value>
            </member>
          </struct>
        </value>
      </data>
    </array>
  </value>
</member>
...

The client will then receive an InfraStructureException.

There should be type checking before casting, if it is not a String object, use the toString() function.

Description

The current XML-RPC (JiraXmlRpcService) does not do type-checking before casting an Object to String, e.g.

private RemoteCustomFieldValue makeCustomFieldValue(Hashtable struct) throws IllegalAccessException, InvocationTargetException
{
  RemoteCustomFieldValue customFieldValue = new RemoteCustomFieldValue();
  customFieldValue.setCustomfieldId((String) struct.get("customfieldId"));
  customFieldValue.setKey((String) struct.get("key"));
  customFieldValue.setValues(makeStringVector((Vector) struct.get("values")));
  return customFieldValue;
}

private String[] makeStringVector(Vector vector)
{
  final String[] strings = new String[vector.size()];
  int i = 0;
  for (Iterator iterator = vector.iterator(); iterator.hasNext();)
  {
    Object j = iterator.next();
    strings[i] = (String) j;
    i++;
  }
  return strings;
}

This should not be a problem, however, say, if a client is using Perl's XMLRPC::Lite, a string-type integer will be converted to and sent as integer-type, e.g.

...
<name>customFieldValues</name>
  <value>
    <array>
      <data>
        <value>
        <value>
          <struct>
            <member>
              <name>customfieldId</name>
              <value>
                <string>customfield_10100</string>
              </value>
            </member>
            <member>
              <name>values</name>
              <value>
                <array>
                  <data>
                    <value>
                      <int>10194</int>
                    </value>
                  </data>
                </array>
              </value>
            </member>
            <member>
              <name>key</name>
              <value>
                <int>1</int>
              </value>
            </member>
          </struct>
        </value>
      </data>
    </array>
  </value>
</member>
...

The client will then receive an InfraStructureException. There should be type checking before casting, if it is not a String object, use the toString() function.

Show »

All

Comments

Work Log

Change History

Sort Order: