Converted String array explicity to string, which is probably what was intended in exception messages. Otherwise end up with something that looks like '[Ljava.lang.String;@7825ed4c' which is not very helpful.

Author: kwwall

src/main/java/org/owasp/esapi/reference/accesscontrol/DelegatingACR.java

@@ -4,6 +4,7 @@
 import java.lang.reflect.Modifier;
 import java.util.Iterator;
 import java.util.Vector;
+import java.util.Arrays;
 
 import org.apache.commons.collections4.iterators.ArrayListIterator;
 
@@ -25,12 +26,12 @@ public void setPolicyParameters(DynaBeanACRParameter policyParameter) {
 		} catch (SecurityException e) {
 			throw new IllegalArgumentException(e.getMessage() + 
 					" delegateClass.delegateMethod(parameterClasses): \"" +  
-					delegateClassName + "." + methodName + "(" + parameterClassNames +
+					delegateClassName + "." + methodName + "(" + Arrays.toString(parameterClassNames) +
 					")\" must be public.", e);
 		} catch (NoSuchMethodException e) {
 			throw new IllegalArgumentException(e.getMessage() + 
 					" delegateClass.delegateMethod(parameterClasses): \"" +  
-					delegateClassName + "." + methodName + "(" + parameterClassNames +
+					delegateClassName + "." + methodName + "(" + Arrays.toString(parameterClassNames) +
 					")\" does not exist.", e);
 		}
 
@@ -42,14 +43,14 @@ public void setPolicyParameters(DynaBeanACRParameter policyParameter) {
 				throw new IllegalArgumentException( 
 						" Delegate class \"" + delegateClassName + 
 						"\" must be concrete, because method " +
-						delegateClassName + "." + methodName + "(" + parameterClassNames +
+					    delegateClassName + "." + methodName + "(" + Arrays.toString(parameterClassNames) +
 						") is not static.", ex);
 			} catch (IllegalAccessException ex) {
 				new IllegalArgumentException( 
 						" Delegate class \"" + delegateClassName + 
 						"\" must must have a zero-argument constructor, because " +
 						"method delegateClass.delegateMethod(parameterClasses): \"" +  
-						delegateClassName + "." + methodName + "(" + parameterClassNames +
+					    delegateClassName + "." + methodName + "(" + Arrays.toString(parameterClassNames) +
 						")\" is not static.", ex);
 			}	
 		} else {