Merge pull request #32683 from sberyozkin/bc_jsse_drbg_native

Reinitialize BouncyCastle DRBG URLSeededEntropySourceProvider at runtime
quarkusio · Apr 18, 2023 · c86dbd6 · c86dbd6
2 parents 329adf7 + d1b5543
commit c86dbd6
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/...s/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java b/...s/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java
@@ -214,6 +214,11 @@ private static void prepareBouncyCastleProvider(CurateOutcomeBuildItem curateOut
                     .produce(new RuntimeReinitializedClassBuildItem("org.bouncycastle.jcajce.provider.drbg.DRBG$Default"));
             runtimeReInitialized
                     .produce(new RuntimeReinitializedClassBuildItem("org.bouncycastle.jcajce.provider.drbg.DRBG$NonceAndIV"));
+            // URLSeededEntropySourceProvider.seedStream may contain a reference to a 'FileInputStream' which includes
+            // references to FileDescriptors which aren't allowed in the image heap
+            runtimeReInitialized
+                    .produce(new RuntimeReinitializedClassBuildItem(
+                            "org.bouncycastle.jcajce.provider.drbg.DRBG$URLSeededEntropySourceProvider"));
         } else {
             reflection.produce(ReflectiveClassBuildItem.builder("org.bouncycastle.crypto.general.AES")
                     .methods().fields().build());