"Extra data detected in stream" - pls make it easier to handle

[ralfhauser]

As per #2360 , please add a "@deprecated" with the explanation to use an InputStream instead as constructor argument

 public CMSSignedData(
        byte[] sigBlock)
        throws CMSException

or clean it by

    asn1In = new ASN1InputStream(is)
   ASN1Primitive asn1Object = asn1In.readObject()
   byte[] encoded = asn1Object.getEncoded();
   return encoded

for example with a static
public static CMSSignedData getCMSSignedDataByCleandBA(byte[] sigBlock) {

[ralfhauser]

or do it directly yourself

public CMSSignedData(
        byte[] sigBlock)
        throws CMSException {
     this(new ByteArrayInputStream(sigBlock));
}

[dghgit]

Sorry, but this one won't get changed. Use ByteArrayInputStream though, that's the simplest approach - I appreciate in some ways this is annoying, but "extra data" sneaking into constructions now getting treated as a source of CVEs (as to whether it should be with such consistency or not I will leave to others to debate, but it does suggest that eventually the PDF issue might get addressed properly).

I'm not sure about the static method, the problem with something like that is similar, we'd have to clearly label it as "unsafe behaviour" not entirely what we're striving for. I think it's better for people to be aware of the decisions they are making. I'll give it a thought though.

[ralfhauser]

Sorry, but this one won't get changed. Use ByteArrayInputStream though, that's the simplest approach - I appreciate in some ways this is annoying, but "extra data" sneaking into constructions now getting treated as a source of CVEs (as to whether it should be with such consistency or not I will leave to others to debate, but it does suggest that eventually the PDF issue might get addressed properly).

I'm not sure about the static method, the problem with something like that is similar, we'd have to clearly label it as "unsafe behaviour" not entirely what we're striving for. I think it's better for people to be aware of the decisions they are making. I'll give it a thought though.

Fine with the idea that "PDF issue should get addressed properly", but at least JavaDoc ? Or is that already a "change" ?

[dghgit]

JavaDoc I can do. Wouldn't hurt either! Should be showing up in a minute.