JACC EJBMethodPermission rant

The EJBMethodPermission has a constructor that takes the method signature as an array.
http://java.sun.com/j2ee/1.4/docs/api/javax/security/jacc/EJBMethodPermission.html


I am referring to:

public EJBMethodPermission(String EJBName,
String methodName,
String methodInterface,
String[] methodParams)

Creates a new EJBMethodPermission with name corresponding to the EJBName and actions composed from methodName, methodInterface, and methodParams.

Parameters:
EJBName - The string representation of the name of the EJB as it appears in the corresponding ejb-name element in the deployment descriptor.

methodName - A string that may be used to indicate the method of the EJB to which the permission pertains. A value of null or "" indicates that the permission pertains to all methods that match the other parameters of the permission specification without consideration of method name.

methodInterface - A string that may be used to specify the EJB interface to which the permission pertains. A value of null or "", indicates that the permission pertains to all methods that match the other parameters of the permission specification without consideration of the interface they occur on.

methodParams - An array of strings that may be used to specify (by typeNames) the parameter signature of the target methods. The order of the typeNames in methodParams array must match the order of occurence of the corresponding parameters in the method signature of the target method(s). Each typeName in the methodParams array must contain the canonical form of the corresponding parameter's typeName as defined by the getActions method. An empty methodParams array is used to represent a method signature with no arguments. A value of null indicates that the permission pertains to all methods that match the other parameters of the permission specification without consideration of method signature.

======================================================

Now if methodParams is an empty array, it indicates a method with zero arguments where as if it is NULL, then it indicates all overloaded method signatures. This is a subtle aspect that can go horribly wrong for container vendors (if not given due attention :) )