[java-identity-provider] branch main updated: IDP-1792 - NPE when filter rule permitAny isn't a boolean

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=3696652e8d48daac3c63eb31d9b4f6fe94c6acae

The following commit(s) were added to refs/heads/main by this push:
       new  3696652e8 IDP-1792 - NPE when filter rule permitAny isn't a boolean
3696652e8 is described below

commit 3696652e8d48daac3c63eb31d9b4f6fe94c6acae
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Apr 8 19:28:56 2021 -0400

    IDP-1792 - NPE when filter rule permitAny isn't a boolean
    
    https://issues.shibboleth.net/jira/browse/IDP-1792
---
 .../filter/spring/impl/AttributeRuleParser.java       | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeRuleParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeRuleParser.java
index 858ba8f30..057099830 100644
--- a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeRuleParser.java
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeRuleParser.java
@@ -60,7 +60,6 @@ public class AttributeRuleParser extends BaseFilterParser {
     }
 
     /** {@inheritDoc} */
-    // Checkstyle: CyclomaticComplexity OFF
     @Override protected void doParse(@Nonnull final Element config, @Nonnull final ParserContext parserContext,
             @Nonnull final BeanDefinitionBuilder builder) {
         super.doParse(config, parserContext, builder);
@@ -94,17 +93,21 @@ public class AttributeRuleParser extends BaseFilterParser {
             builder.addPropertyValue("matcher",
                     SpringSupport.parseCustomElement(denyValueRule.get(0), parserContext, builder, false));
             builder.addPropertyValue("isDenyRule", true);
-
-        } else if (config.hasAttributeNS(null, PERMIT_ANY_ATTRIBUTE)
-                && AttributeSupport.getAttributeValueAsBoolean(config.getAttributeNodeNS(null, PERMIT_ANY_ATTRIBUTE))) {
-            // Note the documented restriction that permitAny cannot be property replaced.
-            builder.addPropertyValue("isDenyRule", false);
-            builder.addPropertyValue("matcher", Matcher.MATCHES_ALL);
         } else {
+            // Note the documented restriction that permitAny cannot be property replaced.
+            if (config.hasAttributeNS(null, PERMIT_ANY_ATTRIBUTE)) {
+                final Boolean permitAny = AttributeSupport.getAttributeValueAsBoolean(
+                        config.getAttributeNodeNS(null, PERMIT_ANY_ATTRIBUTE));
+                if (permitAny != null && permitAny.booleanValue()) {
+                    builder.addPropertyValue("isDenyRule", false);
+                    builder.addPropertyValue("matcher", Matcher.MATCHES_ALL);
+                }
+            }
+            
             log.warn("{}: Attribute rule must have PermitValueRule or a DenyValueRule" +
                     ", or have attribute permitAny=\"true\"",
                     parserContext.getReaderContext().getResource().getDescription());
         }
     }
-    // Checkstyle: CyclomaticComplexity ON
+
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.