XMLEncoder / XMLDecoder : problem with foreign characters

Alright, you asked for it, you got it, here is the idea and code for it :

I have a license file for my app, I wrote it out using XMLEncoder / XMLDecoder, but since I don't want users to see and change its contents, I want to encrypt it, I searched the web for info and came upon the following article : http://www.javalobby.org/articles/serialization/?source=archives

I don't want to serialize my license class because I might change it later and I still want old programs on the user side with old license class to be able to work with the changed new class. Therefore I used the idea in the above article and write out the file with XMLEncoder, but as a serialized string, that way I can encrypt the string later if I want to, but for now, I am stuck, because the XMLEncoder / XMLDecoder have problem with foreign characters.

Here are my methods :

/** Writes the object and CLOSES the stream. Uses the persistance delegate registered in this class.

* @param os The stream to write to.

* @param o The object to be serialized.

*/

public static void writeXMLObject(OutputStream os,Object o)

{

// Classloader reference must be set since netBeans uses another class loader to loead the bean wich will fail in some circumstances.

ClassLoader oldClassLoader=Thread.currentThread().getContextClassLoader();

Thread.currentThread().setContextClassLoader(Tool_Lib.class.getClassLoader());

XMLEncoder encoder=new XMLEncoder(os);

encoder.setExceptionListener(new ExceptionListener() { public void exceptionThrown(Exception e) { e.printStackTrace(); }});

encoder.writeObject(o);

encoder.close();// Must be closed to write

Thread.currentThread().setContextClassLoader(oldClassLoader);

}

private static ByteArrayOutputStream writeOutputStream=new ByteArrayOutputStream(16384);

/** Writes an object to XML.

* @param out The boject out to write to. Will not be closed.

* @param o The object to write.

*/

public static synchronized void writeAsXML(ObjectOutput out,Object o) throws IOException

{

writeOutputStream.reset();

writeXMLObject(writeOutputStream,o);

String Str_1=writeOutputStream.toString();

out.writeObject(Str_1);

out.flush();

}

public static synchronized void Write_Serialized_XML(String File_Path,Object o) throws IOException { writeAsXML(new ObjectOutputStream(new FileOutputStream(File_Path)),o); }

private static byte[] readBuf=new byte[16384];

/** Reads an object from <code>in</code> using the

* @param in The object input to read from.

* @return The object. Never <code>null</code>.

*/

public static synchronized Object readAsXML(ObjectInput in) throws IOException

{

// Classloader reference must be set since netBeans uses another class loader to load the bean which will fail under some circumstances.

ClassLoader oldClassLoader=Thread.currentThread().getContextClassLoader();

Thread.currentThread().setContextClassLoader(Tool_Lib.class.getClassLoader());

String Str="";

try { Str=(String)in.readObject(); }

catch (Exception e) { e .printStackTrace(); }

XMLDecoder dec=new XMLDecoder(new ByteArrayInputStream(Str.getBytes(),0,Str.length()));

Object o=dec.readObject();

Thread.currentThread().setContextClassLoader(oldClassLoader);

return o;

}

public static synchronized Object Read_Serialized_XML(String File_Path) throws IOException { return readAsXML(new ObjectInputStream(new FileInputStream(File_Path))); }

The top level methods you use are :

void Write_Serialized_XML(String File_Path,Object o)

and

Object Read_Serialized_XML(String File_Path)

You can call them like this :

Write_Serialized_XML("C:/My_App/License",A_License_Object);

A_License_Object = Read_Serialized_XML("C:/My_App/License");

They worked fine for files with regular characters, but had error when the file contains foreign characters.

Thanks for replying !

Frank

Ni_Mina at 2007-7-8 22:44:39 >

> Essentially, if you declare in your code .... you won't have the issue of incompatible classes, even if you make changes to your class.

Really ? Is this true ? To what extent ? Can I add/remove variables, add/remove methods and it will still be able to read back old version of the serialized class ?

Frank

Ni_Mina at 2007-7-8 22:44:39 >

Hi DrClap :

Thanks for the pointers, I've changed the methods to look like the following, now it's working and I'm back to square one : the output file is in clear text. I know how to encrypt a string, but not how to encrypt an array of bytes, what can I do to encrypt it before wrting it out ? And then decrypt it before read it in ? Thanks.

public static synchronized void writeAsXML(ObjectOutput out,Object o) throws IOException

{

writeOutputStream.reset();

writeXMLObject(writeOutputStream,o);

byte[] Bt_1=writeOutputStream.toByteArray();

out.writeInt(Bt_1.length);

out.write(Bt_1);

out.flush();

}

public static synchronized Object readAsXML(ObjectInput in) throws IOException

{

// Classloader reference must be set since netBeans uses another class loader to load the bean which will fail under some circumstances.

ClassLoader oldClassLoader=Thread.currentThread().getContextClassLoader();

Thread.currentThread().setContextClassLoader(Tool_Lib.class.getClassLoader());

String Str="";

int length = in.readInt();

if (length > readBuf.length) readBuf = new byte[length];

in.readFully(readBuf,0,length);

XMLDecoder dec=new XMLDecoder(new ByteArrayInputStream(readBuf,0,length));

Object o=dec.readObject();

Thread.currentThread().setContextClassLoader(oldClassLoader);

return o;

}

Frank

Ni_Mina at 2007-7-8 22:44:39 >

Yes, I looked into them , and used some of the code there, but didn't work, it seems simple enough, but I got error messages, and I looked up the error messages in the forum and found some advices, but they didn't work either, I have these methods :

public byte [] encrypt(byte [] plainText,StringBuffer Password)

{

try

{

IvParameterSpec ivSpec=new IvParameterSpec(i_v);

SecretKey secretKey=new SecretKeySpec(getKeyFromPassword(Password),"AES");

Password=null;

Runtime.getRuntime().gc();

Cipher aes=Cipher.getInstance("AES/CBC/PKCS5Padding");

aes.init(Cipher.ENCRYPT_MODE, secretKey, ivSpec);

byte[] cipherText=aes.doFinal(plainText);

Runtime.getRuntime().gc();

return cipherText;

}

catch (Exception e)

{

e.printStackTrace();

Out("Error in encryption:"+e.getMessage());

}

return null;

}

public byte [] decrypt(byte [] cipherText,StringBuffer Password)

{

try

{

IvParameterSpec ivSpec=new IvParameterSpec(i_v);

SecretKey secretKey=new SecretKeySpec(getKeyFromPassword(Password),"AES");

Password=null;

Runtime.getRuntime().gc();

Cipher aes=Cipher.getInstance("AES/CBC/PKCS5Padding");

aes.init(Cipher.DECRYPT_MODE, secretKey, ivSpec);

byte[] plainText=aes.doFinal(cipherText);

Runtime.getRuntime().gc();

//Out(new String(plainText));

return plainText;

}

catch(Exception e) { e.printStackTrace(); }

return null;

}

//converts key to machine readable form

public byte [] getKeyFromPassword(StringBuffer s) { return md5sum(s.toString().getBytes()); }

public static byte [] md5sum(byte [] buffer)

{

try

{

MessageDigest md5=MessageDigest.getInstance("MD5");

md5.update(buffer);

return md5.digest();

}

catch (NoSuchAlgorithmException e) { Out("AES Algorithm not available on this VM"); }

return null;

}

And I got this error message :

javax.crypto.BadPaddingException: Given final block not properly padded

at com.sun.crypto.provider.SunJCE_f.b(DashoA13*..)

at com.sun.crypto.provider.SunJCE_f.b(DashoA13*..)

at com.sun.crypto.provider.AESCipher.engineDoFinal(DashoA13*..)

at javax.crypto.Cipher.doFinal(DashoA13*..)

So I looked in the forum for an answer, someone suggested that I use no padding, but it didn't work either.

Frank

Ni_Mina at 2007-7-8 22:44:39 >