http issue 191: JSON Web Token (JWT) and JSON Web Signature (JWS)

http issue 191: JSON Web Token (JWT) and JSON Web Signature (JWS)
http://code.google.com/p/google-http-java-client/issues/detail?id=191

[peleyal, 2013-02-13 16:30:55]

https://codereview.appspot.com/7322067/diff/1/google-http-client/src/main/jav...
File
google-http-client/src/main/java/com/google/api/client/json/webtoken/JsonWebSignature.java
(right):

https://codereview.appspot.com/7322067/diff/1/google-http-client/src/main/jav...
google-http-client/src/main/java/com/google/api/client/json/webtoken/JsonWebSignature.java:317:
public final byte[] getSignatureBytes() {
why don't you clone the bytes here and also on getSignedContentBytes?
If so, then you will be able to remove EI_EXPOSE_REP,EI_EXPOSE_REP2 from
findbugs-exclude.xml?

https://codereview.appspot.com/7322067/diff/1/google-http-client/src/test/jav...
File
google-http-client/src/test/java/com/google/api/client/http/json/webtoken/JsonWebSignatureTest.java
(right):

https://codereview.appspot.com/7322067/diff/1/google-http-client/src/test/jav...
google-http-client/src/test/java/com/google/api/client/http/json/webtoken/JsonWebSignatureTest.java:35:
public void testSign() throws Exception {
Don't you want to add a test that the sign actually works? e.g. storing a byte[]
of the expected result and then compare it?

[yanivi, 2013-02-13 19:18:52]

added SecurityTestUtils

https://codereview.appspot.com/7322067/diff/1/google-http-client/src/main/jav...
File
google-http-client/src/main/java/com/google/api/client/json/webtoken/JsonWebSignature.java
(right):

https://codereview.appspot.com/7322067/diff/1/google-http-client/src/main/jav...
google-http-client/src/main/java/com/google/api/client/json/webtoken/JsonWebSignature.java:317:
public final byte[] getSignatureBytes() {
On 2013/02/13 16:30:55, peleyal wrote:
> why don't you clone the bytes here and also on getSignedContentBytes?
> If so, then you will be able to remove EI_EXPOSE_REP,EI_EXPOSE_REP2 from
> findbugs-exclude.xml?

Just because it would be an unnecessarily slow implementation.  I changed the
JavaDoc to say that it is a modifiable array of bytes, so user may feel free to
make a copy if they need to.

https://codereview.appspot.com/7322067/diff/1/google-http-client/src/test/jav...
File
google-http-client/src/test/java/com/google/api/client/http/json/webtoken/JsonWebSignatureTest.java
(right):

https://codereview.appspot.com/7322067/diff/1/google-http-client/src/test/jav...
google-http-client/src/test/java/com/google/api/client/http/json/webtoken/JsonWebSignatureTest.java:35:
public void testSign() throws Exception {
On 2013/02/13 16:30:55, peleyal wrote:
> Don't you want to add a test that the sign actually works? e.g. storing a
byte[]
> of the expected result and then compare it?

Done.

[peleyal, 2013-02-13 19:40:30]

LGTM