[java-opensaml] branch main updated: IDP-2069 - Null Handling Task
Scott Cantor
cantor.2 at osu.edu
Thu Apr 6 22:13:13 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=884c163579ac1057491025b9b8c00888e33ec5c6
The following commit(s) were added to refs/heads/main by this push:
new 884c16357 IDP-2069 - Null Handling Task
884c16357 is described below
commit 884c163579ac1057491025b9b8c00888e33ec5c6
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Apr 6 18:12:57 2023 -0400
IDP-2069 - Null Handling Task
https://shibboleth.atlassian.net/browse/IDP-2069
Continue saml-impl cleanup.
---
.../AbstractHttpServletResponseMessageEncoder.java | 2 +-
.../opensaml/saml/config/SAMLConfiguration.java | 5 +-
.../metadata/resolver/index/MetadataIndex.java | 5 +-
.../artifact/SAML1ArtifactBuilderFactory.java | 19 +++--
.../SAMLAddAttributeConsumingServiceHandler.java | 7 +-
.../BaseSAMLSimpleSignatureSecurityHandler.java | 3 +-
.../impl/MessageReplaySecurityHandler.java | 2 +-
.../impl/SAMLMDClientCertAuthSecurityHandler.java | 6 +-
.../resolver/filter/impl/AlgorithmFilter.java | 19 ++++-
.../filter/impl/EntityAttributesFilter.java | 1 +
.../resolver/filter/impl/EntityRoleFilter.java | 2 +
.../resolver/filter/impl/NameIDFormatFilter.java | 1 +
.../resolver/filter/impl/PredicateFilter.java | 1 +
.../filter/impl/SignatureValidationFilter.java | 19 ++---
.../resolver/index/impl/EndpointMetadataIndex.java | 1 +
.../resolver/index/impl/MetadataIndexManager.java | 43 ++++++-----
.../resolver/index/impl/MetadataIndexStore.java | 25 +++----
.../index/impl/SAMLArtifactMetadataIndex.java | 43 ++++++-----
.../binding/decoding/impl/HTTPArtifactDecoder.java | 5 +-
.../binding/decoding/impl/HTTPPostDecoder.java | 12 ++-
.../binding/decoding/impl/HTTPSOAP11Decoder.java | 11 ++-
.../impl/HttpClientResponseSOAP11Decoder.java | 9 ++-
.../binding/encoding/impl/HTTPArtifactEncoder.java | 31 ++++----
.../binding/encoding/impl/HTTPPostEncoder.java | 38 +++++-----
.../binding/encoding/impl/HTTPSOAP11Encoder.java | 7 +-
.../impl/HttpClientRequestSOAP11Encoder.java | 9 ++-
.../impl/SAML1ArtifactRequestIssuerHandler.java | 11 ++-
.../impl/AbstractSubjectConfirmationValidator.java | 85 ++++++++++------------
.../assertion/impl/AuthnStatementValidator.java | 14 ++--
.../DelegationRestrictionConditionValidator.java | 2 +-
.../HolderOfKeySubjectConfirmationValidator.java | 38 ++++++----
.../impl/OneTimeUseConditionValidator.java | 20 +++--
.../impl/ProxyRestrictionConditionValidator.java | 3 +-
.../http/impl/HttpClientRequestSOAP11Encoder.java | 2 +-
34 files changed, 276 insertions(+), 225 deletions(-)
diff --git a/opensaml-messaging-api/src/main/java/org/opensaml/messaging/encoder/servlet/AbstractHttpServletResponseMessageEncoder.java b/opensaml-messaging-api/src/main/java/org/opensaml/messaging/encoder/servlet/AbstractHttpServletResponseMessageEncoder.java
index 05b11ec0b..9e9c5beac 100644
--- a/opensaml-messaging-api/src/main/java/org/opensaml/messaging/encoder/servlet/AbstractHttpServletResponseMessageEncoder.java
+++ b/opensaml-messaging-api/src/main/java/org/opensaml/messaging/encoder/servlet/AbstractHttpServletResponseMessageEncoder.java
@@ -38,7 +38,7 @@ public abstract class AbstractHttpServletResponseMessageEncoder extends Abstract
/**
* {@inheritDoc}
*/
- @Nullable public HttpServletResponse getHttpServletResponse() {
+ @NonnullAfterInit public HttpServletResponse getHttpServletResponse() {
if (httpServletResponseSupplier != null) {
return httpServletResponseSupplier.get();
}
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/config/SAMLConfiguration.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/config/SAMLConfiguration.java
index 2764a2b2d..74634d93e 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/config/SAMLConfiguration.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/config/SAMLConfiguration.java
@@ -27,7 +27,6 @@ import javax.annotation.Nullable;
import org.opensaml.saml.saml1.binding.artifact.SAML1ArtifactBuilderFactory;
import org.opensaml.saml.saml2.binding.artifact.SAML2ArtifactBuilderFactory;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
import net.shibboleth.shared.collection.CollectionSupport;
@@ -55,7 +54,7 @@ public class SAMLConfiguration {
/** The list of schemes allowed to appear in binding URLs when encoding a message.
* Defaults to 'http' and 'https'. */
- @Nonnull @NonnullElements @Unmodifiable @NotLive private List<String> allowedBindingURLSchemes;
+ @Nonnull @Unmodifiable @NotLive private List<String> allowedBindingURLSchemes;
/**
@@ -115,7 +114,7 @@ public class SAMLConfiguration {
*
* @return list of URL schemes allowed to appear in a message
*/
- @Nonnull @NonnullElements @Unmodifiable @NotLive public List<String> getAllowedBindingURLSchemes() {
+ @Nonnull @Unmodifiable @NotLive public List<String> getAllowedBindingURLSchemes() {
return allowedBindingURLSchemes;
}
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/index/MetadataIndex.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/index/MetadataIndex.java
index 4f528ca3b..22a1a92a6 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/index/MetadataIndex.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/index/MetadataIndex.java
@@ -22,7 +22,6 @@ import java.util.Set;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
import net.shibboleth.shared.resolver.CriteriaSet;
@@ -49,7 +48,7 @@ public interface MetadataIndex {
* @return the set of index keys generated from the criteria. May be null or empty,
* but will not contain null elements.
*/
- @Nullable @NonnullElements @Unmodifiable @NotLive
+ @Nullable @Unmodifiable @NotLive
public Set<MetadataIndexKey> generateKeys(@Nonnull final EntityDescriptor descriptor);
/**
@@ -65,7 +64,7 @@ public interface MetadataIndex {
* @return the set of index keys generated from the criteria. May be null or empty,
* but will not contain null elements.
*/
- @Nullable @NonnullElements @Unmodifiable @NotLive
+ @Nullable @Unmodifiable @NotLive
public Set<MetadataIndexKey> generateKeys(@Nonnull final CriteriaSet criteriaSet);
}
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/binding/artifact/SAML1ArtifactBuilderFactory.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/binding/artifact/SAML1ArtifactBuilderFactory.java
index 4a8baf1fd..71454ce2b 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/binding/artifact/SAML1ArtifactBuilderFactory.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/binding/artifact/SAML1ArtifactBuilderFactory.java
@@ -23,8 +23,11 @@ import java.util.Map;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
import net.shibboleth.shared.codec.Base64Support;
import net.shibboleth.shared.codec.DecodingException;
+import net.shibboleth.shared.collection.CollectionSupport;
/**
* Factory used to construct SAML 1 artifact builders.
@@ -32,13 +35,14 @@ import net.shibboleth.shared.codec.DecodingException;
public class SAML1ArtifactBuilderFactory {
/** Registered artifact builders. */
- private Map<String, SAML1ArtifactBuilder<?>> artifactBuilders;
+ @Nonnull private final Map<String, SAML1ArtifactBuilder<?>> artifactBuilders;
/** Constructor. */
public SAML1ArtifactBuilderFactory() {
- artifactBuilders = new HashMap<>(2);
- artifactBuilders.put(new String(SAML1ArtifactType0001.TYPE_CODE), new SAML1ArtifactType0001Builder());
- artifactBuilders.put(new String(SAML1ArtifactType0002.TYPE_CODE), new SAML1ArtifactType0002Builder());
+ final Map<String, SAML1ArtifactBuilder<?>> sourceMap = new HashMap<>(2);
+ sourceMap.put(new String(SAML1ArtifactType0001.TYPE_CODE), new SAML1ArtifactType0001Builder());
+ sourceMap.put(new String(SAML1ArtifactType0002.TYPE_CODE), new SAML1ArtifactType0002Builder());
+ artifactBuilders = CollectionSupport.copyToMap(sourceMap);
}
/**
@@ -46,7 +50,7 @@ public class SAML1ArtifactBuilderFactory {
*
* @return currently registered artifact builders
*/
- public Map<String, SAML1ArtifactBuilder<?>> getArtifactBuilders() {
+ @Nonnull @NotLive @Unmodifiable public Map<String, SAML1ArtifactBuilder<?>> getArtifactBuilders() {
return artifactBuilders;
}
@@ -57,7 +61,7 @@ public class SAML1ArtifactBuilderFactory {
*
* @return artifact builder for the given type
*/
- public SAML1ArtifactBuilder<?> getArtifactBuilder(final byte[] type) {
+ @Nullable public SAML1ArtifactBuilder<?> getArtifactBuilder(final byte[] type) {
return artifactBuilders.get(new String(type));
}
@@ -70,7 +74,7 @@ public class SAML1ArtifactBuilderFactory {
*
* @throws DecodingException if the <code>base64Artifact</code> could not be base64-decoded.
*/
- public SAML1Artifact buildArtifact(@Nonnull final String base64Artifact) throws DecodingException {
+ @Nullable public SAML1Artifact buildArtifact(@Nonnull final String base64Artifact) throws DecodingException {
return buildArtifact(Base64Support.decode(base64Artifact));
}
@@ -96,4 +100,5 @@ public class SAML1ArtifactBuilderFactory {
}
return artifactBuilder.buildArtifact(artifact);
}
+
}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/SAMLAddAttributeConsumingServiceHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/SAMLAddAttributeConsumingServiceHandler.java
index 362db3ce4..c0c264d5e 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/SAMLAddAttributeConsumingServiceHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/SAMLAddAttributeConsumingServiceHandler.java
@@ -64,7 +64,6 @@ public class SAMLAddAttributeConsumingServiceHandler extends AbstractMessageHand
@Nonnull private Function<MessageContext, AuthnRequest> authnRequestLookupStrategy;
/** {@link AttributeConsumingService} index - if specified. */
-
@Nullable private Integer index;
/** {@link RequestedAttribute} list - if specified. */
@@ -109,7 +108,6 @@ public class SAMLAddAttributeConsumingServiceHandler extends AbstractMessageHand
}
final AuthnRequest authn = authnRequestLookupStrategy.apply(messageContext);
-
if (authn != null) {
index = authn.getAttributeConsumingServiceIndex();
requestedAttributes = getRequestedAttributes(messageContext, authn);
@@ -121,6 +119,7 @@ public class SAMLAddAttributeConsumingServiceHandler extends AbstractMessageHand
index = null;
}
}
+
return true;
}
@@ -148,8 +147,10 @@ public class SAMLAddAttributeConsumingServiceHandler extends AbstractMessageHand
AttributeConsumingService acs = null;
if (null != index) {
log.debug("{} Request specified AttributeConsumingService index {}", getLogPrefix(), index);
+ assert ssoDescriptor != null;
for (final AttributeConsumingService acsEntry : ssoDescriptor.getAttributeConsumingServices()) {
- if (index.intValue() == acsEntry.getIndex()) {
+ assert index != null;
+ if (index.equals(acsEntry.getIndex())) {
acs = acsEntry;
break;
}
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/BaseSAMLSimpleSignatureSecurityHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/BaseSAMLSimpleSignatureSecurityHandler.java
index b56dd67d6..6cb2f7239 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/BaseSAMLSimpleSignatureSecurityHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/BaseSAMLSimpleSignatureSecurityHandler.java
@@ -155,7 +155,8 @@ public abstract class BaseSAMLSimpleSignatureSecurityHandler extends AbstractMes
final SecurityParametersContext secParams = messageContext.getSubcontext(SecurityParametersContext.class);
signatureValidationParameters = secParams != null ? secParams.getSignatureValidationParameters() : null;
- trustEngine = signatureValidationParameters != null ? signatureValidationParameters.getSignatureTrustEngine() : null;
+ trustEngine = signatureValidationParameters != null
+ ? signatureValidationParameters.getSignatureTrustEngine() : null;
if (trustEngine == null) {
throw new MessageHandlerException("No SignatureTrustEngine was available from the MessageContext");
}
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/MessageReplaySecurityHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/MessageReplaySecurityHandler.java
index 59ada3960..7bce6ca1f 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/MessageReplaySecurityHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/MessageReplaySecurityHandler.java
@@ -29,11 +29,11 @@ import org.opensaml.saml.common.messaging.context.SAMLMessageInfoContext;
import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
import org.opensaml.storage.ReplayCache;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/SAMLMDClientCertAuthSecurityHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/SAMLMDClientCertAuthSecurityHandler.java
index 12489f060..9941e9b28 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/SAMLMDClientCertAuthSecurityHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/SAMLMDClientCertAuthSecurityHandler.java
@@ -99,10 +99,12 @@ public class SAMLMDClientCertAuthSecurityHandler extends BaseClientCertAuthSecur
entityContextClass.getName());
final AbstractAuthenticatableSAMLEntityContext entityContext =
messageContext.ensureSubcontext(entityContextClass);
- criteriaSet.add(new EntityRoleCriterion(Constraint.isNotNull(entityContext.getRole(), "SAML entity role was null")));
+ criteriaSet.add(new EntityRoleCriterion(
+ Constraint.isNotNull(entityContext.getRole(), "SAML entity role was null")));
final SAMLProtocolContext protocolContext = messageContext.ensureSubcontext(SAMLProtocolContext.class);
- criteriaSet.add(new ProtocolCriterion(Constraint.isNotNull(protocolContext.getProtocol(), "SAML protocol was null")));
+ criteriaSet.add(new ProtocolCriterion(
+ Constraint.isNotNull(protocolContext.getProtocol(), "SAML protocol was null")));
} catch (final ConstraintViolationException e) {
throw new MessageHandlerException(e);
}
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilter.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilter.java
index b395545dc..9e698d44e 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilter.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilter.java
@@ -51,7 +51,6 @@ import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
import org.opensaml.xmlsec.algorithm.AlgorithmRegistry;
import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
import org.slf4j.Logger;
-
import com.google.common.collect.ArrayListMultimap;
import com.google.common.collect.Multimap;
@@ -296,7 +295,11 @@ public class AlgorithmFilter extends AbstractInitializableComponent implements M
*
* @param uri input method
*/
- private void checkDigestMethod(@Nonnull @NotEmpty final String uri) {
+ private void checkDigestMethod(@Nullable @NotEmpty final String uri) {
+ if (uri == null) {
+ return;
+ }
+
final AlgorithmRegistry local = registry;
if (local != null) {
if (!local.getRegisteredURIsByType(AlgorithmType.MessageDigest).contains(uri)) {
@@ -312,7 +315,11 @@ public class AlgorithmFilter extends AbstractInitializableComponent implements M
*
* @param uri input method
*/
- private void checkSigningMethod(@Nonnull @NotEmpty final String uri) {
+ private void checkSigningMethod(@Nullable @NotEmpty final String uri) {
+ if (uri == null) {
+ return;
+ }
+
final AlgorithmRegistry local = registry;
if (local != null) {
if (!local.getRegisteredURIsByType(AlgorithmType.Signature).contains(uri) &&
@@ -329,7 +336,11 @@ public class AlgorithmFilter extends AbstractInitializableComponent implements M
*
* @param uri input method
*/
- private void checkEncryptionMethod(@Nonnull @NotEmpty final String uri) {
+ private void checkEncryptionMethod(@Nullable @NotEmpty final String uri) {
+ if (uri == null) {
+ return;
+ }
+
final AlgorithmRegistry local = registry;
if (local != null) {
if (!local.getRegisteredURIsByType(AlgorithmType.BlockEncryption).contains(uri) &&
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityAttributesFilter.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityAttributesFilter.java
index 156b7827f..810b5acd6 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityAttributesFilter.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityAttributesFilter.java
@@ -166,6 +166,7 @@ public class EntityAttributesFilter extends AbstractInitializableComponent imple
final EntityAttributes entityAttributes =
(EntityAttributes) entityAttributesCollection.iterator().next();
+ assert entityAttributes != null;
entry.getValue().forEach(a -> addEntityAttribute(descriptor, entityAttributes, a));
}
}
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityRoleFilter.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityRoleFilter.java
index 5b7aaedd1..853dbecfb 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityRoleFilter.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityRoleFilter.java
@@ -184,6 +184,7 @@ public class EntityRoleFilter implements MetadataFilter {
List<RoleDescriptor> entityRoles;
while (entityDescriptorsItr.hasNext()) {
entityDescriptor = entityDescriptorsItr.next();
+ assert entityDescriptor != null;
filterEntityDescriptor(entityDescriptor);
if (getRemoveRolelessEntityDescriptors() && entityDescriptor.getAffiliationDescriptor() == null) {
entityRoles = entityDescriptor.getRoleDescriptors();
@@ -205,6 +206,7 @@ public class EntityRoleFilter implements MetadataFilter {
EntitiesDescriptor entitiesDescriptor;
while (entitiesDescriptorsItr.hasNext()) {
entitiesDescriptor = entitiesDescriptorsItr.next();
+ assert entitiesDescriptor != null;
filterEntitiesDescriptor(entitiesDescriptor);
if (getRemoveEmptyEntitiesDescriptors()) {
// Remove the EntitiesDescriptor if does not contain any EntitiesDescriptors or EntityDescriptors
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/NameIDFormatFilter.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/NameIDFormatFilter.java
index 152443237..7d18e48c0 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/NameIDFormatFilter.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/NameIDFormatFilter.java
@@ -136,6 +136,7 @@ public class NameIDFormatFilter extends AbstractInitializableComponent implement
for (final Map.Entry<Predicate<EntityDescriptor>,Collection<String>> entry : applyMap.asMap().entrySet()) {
if (!entry.getValue().isEmpty() && entry.getKey().test(descriptor)) {
for (final RoleDescriptor role : descriptor.getRoleDescriptors()) {
+ assert role != null;
filterRoleDescriptor(role, entry.getValue());
}
}
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/PredicateFilter.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/PredicateFilter.java
index 69e71a23c..8c0f6efa0 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/PredicateFilter.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/PredicateFilter.java
@@ -175,6 +175,7 @@ public class PredicateFilter implements MetadataFilter {
final Iterator<EntitiesDescriptor> entitiesDescriptorsItr = entitiesDescriptors.iterator();
while (entitiesDescriptorsItr.hasNext()) {
final EntitiesDescriptor entitiesDescriptor = entitiesDescriptorsItr.next();
+ assert entitiesDescriptor != null;
filterEntitiesDescriptor(entitiesDescriptor);
if (getRemoveEmptyEntitiesDescriptors()) {
// Remove the EntitiesDescriptor if empty.
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java
index 3c347f92f..608190fd2 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java
@@ -370,6 +370,7 @@ public class SignatureValidationFilter implements MetadataFilter {
final Iterator<EntitiesDescriptor> entitiesIter = entitiesDescriptor.getEntitiesDescriptors().iterator();
while(entitiesIter.hasNext()) {
final EntitiesDescriptor entitiesChild = entitiesIter.next();
+ assert entitiesChild != null;
final String childName = getGroupName(entitiesChild);
log.trace("Processing EntitiesDescriptor member: {}", childName);
try {
@@ -403,7 +404,7 @@ public class SignatureValidationFilter implements MetadataFilter {
* or if an error occurs during the signature verification process
*/
protected void verifySignature(@Nonnull final SignableXMLObject signedMetadata,
- @Nonnull @NotEmpty final String metadataEntryName, final boolean isEntityGroup) throws FilterException {
+ @Nullable @NotEmpty final String metadataEntryName, final boolean isEntityGroup) throws FilterException {
log.debug("Verifying signature on metadata entry: {}", metadataEntryName);
@@ -416,7 +417,7 @@ public class SignatureValidationFilter implements MetadataFilter {
performPreValidation(signature, metadataEntryName);
- final CriteriaSet criteriaSet = buildCriteriaSet(signedMetadata, metadataEntryName, isEntityGroup);
+ final CriteriaSet criteriaSet = buildCriteriaSet(signedMetadata, isEntityGroup);
try {
if (getSignatureTrustEngine().validate(signature, criteriaSet)) {
@@ -446,7 +447,7 @@ public class SignatureValidationFilter implements MetadataFilter {
* @throws FilterException thrown if the signature element fails pre-validation
*/
protected void performPreValidation(@Nonnull final Signature signature,
- @Nonnull @NotEmpty final String metadataEntryName) throws FilterException {
+ @Nullable @NotEmpty final String metadataEntryName) throws FilterException {
final var prevalidator = getSignaturePrevalidator();
if (prevalidator != null) {
try {
@@ -463,17 +464,11 @@ public class SignatureValidationFilter implements MetadataFilter {
* Build the criteria set which will be used as input to the configured trust engine.
*
* @param signedMetadata the metadata element whose signature is being verified
- * @param metadataEntryName the EntityDescriptor entityID, EntitiesDescriptor Name,
- * AffiliationDescriptor affiliationOwnerID,
- * or RoleDescriptor {@link #getRoleIDToken(String, RoleDescriptor)}
- * corresponding to the element whose signature is being evaluated.
- * This is used exclusively for logging/debugging purposes and
- * should not be used operationally (e.g. for building the criteria set).
* @param isEntityGroup flag indicating whether the signed object is a metadata group (EntitiesDescriptor)
* @return the newly constructed criteria set
*/
@Nonnull protected CriteriaSet buildCriteriaSet(@Nonnull final SignableXMLObject signedMetadata,
- @Nonnull @NotEmpty final String metadataEntryName, final boolean isEntityGroup) {
+ final boolean isEntityGroup) {
final CriteriaSet newCriteriaSet = new CriteriaSet();
@@ -505,10 +500,10 @@ public class SignatureValidationFilter implements MetadataFilter {
*
* @return the constructed role ID token.
*/
- @Nonnull protected String getRoleIDToken(@Nonnull @NotEmpty final String entityID,
+ @Nonnull protected String getRoleIDToken(@Nullable @NotEmpty final String entityID,
@Nonnull final RoleDescriptor role) {
final String roleName = role.getElementQName().getLocalPart();
- return "[Role: " + entityID + "::" + roleName + "]";
+ return "[Role: " + (entityID != null ? entityID : "(unnamed)") + "::" + roleName + "]";
}
/**
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/EndpointMetadataIndex.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/EndpointMetadataIndex.java
index bbea0391c..13baf4162 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/EndpointMetadataIndex.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/EndpointMetadataIndex.java
@@ -133,6 +133,7 @@ public class EndpointMetadataIndex implements MetadataIndex {
public Set<MetadataIndexKey> generateKeys(@Nonnull final CriteriaSet criteriaSet) {
Constraint.isNotNull(criteriaSet, "CriteriaSet was null");
final EntityRoleCriterion roleCrit = criteriaSet.get(EntityRoleCriterion.class);
+ @SuppressWarnings("unchecked")
final EndpointCriterion<Endpoint> endpointCrit = criteriaSet.get(EndpointCriterion.class);
if (roleCrit != null && endpointCrit != null) {
final HashSet<MetadataIndexKey> result = new HashSet<>();
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexManager.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexManager.java
index 0c87adac4..26b8151e1 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexManager.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexManager.java
@@ -17,7 +17,6 @@
package org.opensaml.saml.metadata.resolver.index.impl;
-import java.util.Collections;
import java.util.HashSet;
import java.util.Map;
import java.util.Optional;
@@ -32,13 +31,14 @@ import org.opensaml.saml.metadata.resolver.index.MetadataIndex;
import org.opensaml.saml.metadata.resolver.index.MetadataIndexKey;
import org.opensaml.saml.saml2.metadata.EntityDescriptor;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.collection.LazySet;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
@@ -52,13 +52,13 @@ import net.shibboleth.shared.resolver.CriteriaSet;
public class MetadataIndexManager<T> {
/** Logger. */
- private Logger log = LoggerFactory.getLogger(MetadataIndexManager.class);
+ @Nonnull private Logger log = LoggerFactory.getLogger(MetadataIndexManager.class);
/** Storage for secondary indexes. */
- private Map<MetadataIndex, MetadataIndexStore<T>> indexes;
+ @Nonnull private final Map<MetadataIndex, MetadataIndexStore<T>> indexes;
/** Function to extract the data item to be indexed from an EntityDescriptor. */
- private Function<EntityDescriptor,T> entityDescriptorFunction;
+ @Nonnull private final Function<EntityDescriptor,T> entityDescriptorFunction;
/**
* Constructor.
@@ -88,9 +88,8 @@ public class MetadataIndexManager<T> {
*
* @return the set of all current indexes
*/
- @Nonnull @NonnullElements @Unmodifiable @NotLive
- public Set<MetadataIndex> getIndexes() {
- return Set.copyOf(indexes.keySet());
+ @Nonnull @Unmodifiable @NotLive public Set<MetadataIndex> getIndexes() {
+ return CollectionSupport.copyToSet(indexes.keySet());
}
/**
@@ -124,8 +123,10 @@ public class MetadataIndexManager<T> {
if (keys != null && !keys.isEmpty()) {
final LazySet<T> indexResult = new LazySet<>();
final MetadataIndexStore<T> indexStore = getStore(index);
- for (final MetadataIndexKey key : keys) {
- indexResult.addAll(indexStore.lookup(key));
+ if (indexStore != null) {
+ for (final MetadataIndexKey key : keys) {
+ indexResult.addAll(indexStore.lookup(key));
+ }
}
log.trace("MetadataIndex '{}' produced results: {}", index, indexResult);
if (items.isEmpty()) {
@@ -138,7 +139,7 @@ public class MetadataIndexManager<T> {
+ "terminating early and returning empty result set", index);
// Return present+empty here to indicate there were applicable indexes for the criteria,
// but no indexed data.
- return Optional.of(Collections.<T>emptySet());
+ return Optional.of(CollectionSupport.emptySet());
}
}
}
@@ -167,10 +168,12 @@ public class MetadataIndexManager<T> {
final Set<MetadataIndexKey> keys = index.generateKeys(descriptor);
if (keys != null && !keys.isEmpty()) {
final MetadataIndexStore<T> store = getStore(index);
- for (final MetadataIndexKey key : keys) {
- log.trace("Indexing metadata: index '{}', key '{}', data item '{}'",
- index, key, item);
- store.add(key, item);
+ if (store != null) {
+ for (final MetadataIndexKey key : keys) {
+ log.trace("Indexing metadata: index '{}', key '{}', data item '{}'",
+ index, key, item);
+ store.add(key, item);
+ }
}
}
}
@@ -191,10 +194,12 @@ public class MetadataIndexManager<T> {
final Set<MetadataIndexKey> keys = index.generateKeys(descriptor);
if (keys != null && !keys.isEmpty()) {
final MetadataIndexStore<T> store = getStore(index);
- for (final MetadataIndexKey key : keys) {
- log.trace("De-indexing metadata: index '{}', key '{}', data item '{}'",
- index, key, item);
- store.remove(key, item);
+ if (store != null) {
+ for (final MetadataIndexKey key : keys) {
+ log.trace("De-indexing metadata: index '{}', key '{}', data item '{}'",
+ index, key, item);
+ store.remove(key, item);
+ }
}
}
}
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexStore.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexStore.java
index f3e331735..0d10315dc 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexStore.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexStore.java
@@ -17,7 +17,6 @@
package org.opensaml.saml.metadata.resolver.index.impl;
-import java.util.Collections;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
@@ -27,11 +26,9 @@ import javax.annotation.Nonnull;
import org.opensaml.saml.metadata.resolver.index.MetadataIndexKey;
-import com.google.common.collect.ImmutableSet;
-
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
/**
@@ -44,7 +41,7 @@ import net.shibboleth.shared.logic.Constraint;
public class MetadataIndexStore<T> {
/** The indexed storage of data. */
- @Nonnull private Map<MetadataIndexKey, Set<T>> index;
+ @Nonnull private final Map<MetadataIndexKey, Set<T>> index;
/**
* Constructor.
@@ -58,9 +55,8 @@ public class MetadataIndexStore<T> {
*
* @return the set of all currently indexed keys
*/
- @Nonnull @NonnullElements @Unmodifiable @NotLive
- public Set<MetadataIndexKey> getKeys() {
- return ImmutableSet.copyOf(index.keySet());
+ @Nonnull @Unmodifiable @NotLive public Set<MetadataIndexKey> getKeys() {
+ return CollectionSupport.copyToSet(index.keySet());
}
/**
@@ -69,14 +65,13 @@ public class MetadataIndexStore<T> {
* @param key the index key to lookup
* @return the set of data items indexed under that key
*/
- @Nonnull @NonnullElements @Unmodifiable @NotLive
- public Set<T> lookup(@Nonnull final MetadataIndexKey key) {
+ @Nonnull @Unmodifiable @NotLive public Set<T> lookup(@Nonnull final MetadataIndexKey key) {
Constraint.isNotNull(key, "IndexKey was null");
final Set<T> items = index.get(key);
if (items == null) {
- return Collections.emptySet();
+ return CollectionSupport.emptySet();
}
- return ImmutableSet.copyOf(items);
+ return CollectionSupport.copyToSet(items);
}
/**
@@ -85,7 +80,7 @@ public class MetadataIndexStore<T> {
* @param key the index key
* @param item the data item to index
*/
- public void add(final MetadataIndexKey key, final T item) {
+ public void add(@Nonnull final MetadataIndexKey key, @Nonnull final T item) {
Constraint.isNotNull(key, "IndexKey was null");
Constraint.isNotNull(item, "The indexed data element was null");
Set<T> items = index.get(key);
@@ -102,7 +97,7 @@ public class MetadataIndexStore<T> {
* @param key the index key
* @param item the data item to index
*/
- public void remove(final MetadataIndexKey key, final T item) {
+ public void remove(@Nonnull final MetadataIndexKey key, @Nonnull final T item) {
Constraint.isNotNull(key, "IndexKey was null");
Constraint.isNotNull(item, "The indexed data element was null");
final Set<T> items = index.get(key);
@@ -117,7 +112,7 @@ public class MetadataIndexStore<T> {
*
* @param key the index key
*/
- public void clear(final MetadataIndexKey key) {
+ public void clear(@Nonnull final MetadataIndexKey key) {
Constraint.isNotNull(key, "IndexKey was null");
index.remove(key);
}
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java
index 8584ffd94..54e7d9ee7 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java
@@ -49,14 +49,15 @@ import org.opensaml.saml.saml2.metadata.RoleDescriptor;
import org.opensaml.saml.saml2.metadata.SSODescriptor;
import org.opensaml.security.crypto.JCAConstants;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.google.common.base.MoreObjects;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.collection.LazySet;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
@@ -81,7 +82,7 @@ public class SAMLArtifactMetadataIndex implements MetadataIndex {
* </ul>
*/
public SAMLArtifactMetadataIndex() {
- this(Arrays.asList(
+ this(CollectionSupport.listOf(
new EntityIDToSHA1SourceIDIndexingFunction(),
new SourceIDExtensionIndexingFunction(),
new SourceLocationIndexingFunction()
@@ -95,7 +96,7 @@ public class SAMLArtifactMetadataIndex implements MetadataIndex {
*/
public SAMLArtifactMetadataIndex(
@Nonnull final List<Function<EntityDescriptor, Set<MetadataIndexKey>>> descriptorIndexingFunctions) {
- indexingFunctions = List.copyOf(
+ indexingFunctions = CollectionSupport.copyToList(
Constraint.isNotNull(descriptorIndexingFunctions,
"EntityDescriptor indexing functions list may not be null"));
Constraint.isNotEmpty(indexingFunctions, "EntityDescriptor indexing functions list may not be empty");
@@ -146,10 +147,10 @@ public class SAMLArtifactMetadataIndex implements MetadataIndex {
implements Function<EntityDescriptor, Set<MetadataIndexKey>> {
/** Logger. */
- private Logger log = LoggerFactory.getLogger(EntityIDToSHA1SourceIDIndexingFunction.class);
+ @Nonnull private Logger log = LoggerFactory.getLogger(EntityIDToSHA1SourceIDIndexingFunction.class);
/** {@inheritDoc} */
- public Set<MetadataIndexKey> apply(@Nonnull final EntityDescriptor descriptor) {
+ @Nullable public Set<MetadataIndexKey> apply(@Nullable final EntityDescriptor descriptor) {
if (descriptor == null) {
return null;
}
@@ -161,6 +162,7 @@ public class SAMLArtifactMetadataIndex implements MetadataIndex {
try {
final MessageDigest sha1Digester = MessageDigest.getInstance(JCAConstants.DIGEST_SHA1);
final byte[] sourceID = sha1Digester.digest(entityID.getBytes("UTF-8"));
+ assert sourceID != null;
final ArtifactSourceIDMetadataIndexKey key = new ArtifactSourceIDMetadataIndexKey(sourceID);
log.trace("For entityID '{}' produced artifact SourceID index key: {}", entityID, key);
return Collections.<MetadataIndexKey>singleton(key);
@@ -187,10 +189,10 @@ public class SAMLArtifactMetadataIndex implements MetadataIndex {
implements Function<EntityDescriptor, Set<MetadataIndexKey>> {
/** Logger. */
- private Logger log = LoggerFactory.getLogger(SourceIDExtensionIndexingFunction.class);
+ @Nonnull private Logger log = LoggerFactory.getLogger(SourceIDExtensionIndexingFunction.class);
/** {@inheritDoc} */
- public Set<MetadataIndexKey> apply(@Nonnull final EntityDescriptor descriptor) {
+ @Nullable public Set<MetadataIndexKey> apply(@Nullable final EntityDescriptor descriptor) {
if (descriptor == null) {
return null;
}
@@ -213,6 +215,7 @@ public class SAMLArtifactMetadataIndex implements MetadataIndex {
if (extSourceIDHex != null) {
try {
final byte[] sourceID = Hex.decodeHex(extSourceIDHex.toCharArray());
+ assert sourceID != null;
final ArtifactSourceIDMetadataIndexKey key =
new ArtifactSourceIDMetadataIndexKey(sourceID);
log.trace("For SourceID extension value '{}' produced index key: {}",
@@ -242,10 +245,10 @@ public class SAMLArtifactMetadataIndex implements MetadataIndex {
public static class SourceLocationIndexingFunction implements Function<EntityDescriptor, Set<MetadataIndexKey>> {
/** Logger. */
- private Logger log = LoggerFactory.getLogger(SourceLocationIndexingFunction.class);
+ @Nonnull private Logger log = LoggerFactory.getLogger(SourceLocationIndexingFunction.class);
/** {@inheritDoc} */
- public Set<MetadataIndexKey> apply(@Nonnull final EntityDescriptor descriptor) {
+ @Nullable public Set<MetadataIndexKey> apply(@Nullable final EntityDescriptor descriptor) {
if (descriptor == null) {
return null;
}
@@ -253,21 +256,23 @@ public class SAMLArtifactMetadataIndex implements MetadataIndex {
final LazySet<MetadataIndexKey> results = new LazySet<>();
for (final RoleDescriptor roleDescriptor : descriptor.getRoleDescriptors()) {
- if (roleDescriptor instanceof SSODescriptor) {
- final List<ArtifactResolutionService> arsList =
- ((SSODescriptor)roleDescriptor).getArtifactResolutionServices();
- if (arsList != null && !arsList.isEmpty()) {
+ if (roleDescriptor instanceof SSODescriptor sso) {
+ final List<ArtifactResolutionService> arsList = sso.getArtifactResolutionServices();
+ if (!arsList.isEmpty()) {
final QName role = descriptor.getSchemaType() != null ? roleDescriptor.getSchemaType()
: roleDescriptor.getElementQName();
log.trace("Processing ArtifactResolutionService locations for entityID '{}' with role '{}'",
descriptor.getEntityID(), role);
for (final ArtifactResolutionService ars : arsList) {
- final ArtifactSourceLocationMetadataIndexKey key =
- new ArtifactSourceLocationMetadataIndexKey(ars.getLocation());
- log.trace("For entityID '{}' produced artifact source location index key: {}",
- descriptor.getEntityID(), key);
- results.add(key);
+ final String location = ars.getLocation();
+ if (location != null) {
+ final ArtifactSourceLocationMetadataIndexKey key =
+ new ArtifactSourceLocationMetadataIndexKey(location);
+ log.trace("For entityID '{}' produced artifact source location index key: {}",
+ descriptor.getEntityID(), key);
+ results.add(key);
+ }
}
}
}
@@ -341,7 +346,7 @@ public class SAMLArtifactMetadataIndex implements MetadataIndex {
protected static class ArtifactSourceLocationMetadataIndexKey implements MetadataIndexKey {
/** Logger. */
- private Logger log = LoggerFactory.getLogger(ArtifactSourceLocationMetadataIndexKey.class);
+ @Nonnull private Logger log = LoggerFactory.getLogger(ArtifactSourceLocationMetadataIndexKey.class);
/** The location. */
@Nonnull private final String location;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPArtifactDecoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPArtifactDecoder.java
index 058b2dd36..9607b98c8 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPArtifactDecoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPArtifactDecoder.java
@@ -29,10 +29,10 @@ import org.opensaml.saml.common.binding.decoding.SAMLMessageDecoder;
import org.opensaml.saml.common.messaging.context.SAMLBindingContext;
import org.opensaml.saml.common.xml.SAMLConstants;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import jakarta.servlet.http.HttpServletRequest;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -76,6 +76,7 @@ public class HTTPArtifactDecoder extends BaseHttpServletRequestXMLMessageDecoder
protected void doDecode() throws MessageDecodingException {
final MessageContext messageContext = new MessageContext();
final HttpServletRequest request = getHttpServletRequest();
+ assert request != null;
decodeTarget(messageContext, request);
processArtifacts(messageContext, request);
@@ -93,7 +94,7 @@ public class HTTPArtifactDecoder extends BaseHttpServletRequestXMLMessageDecoder
*
* @throws MessageDecodingException thrown if there is a problem decoding the TARGET parameter.
*/
- protected void decodeTarget(final MessageContext messageContext, final HttpServletRequest request)
+ protected void decodeTarget(@Nonnull final MessageContext messageContext, @Nonnull final HttpServletRequest request)
throws MessageDecodingException {
final String target = StringSupport.trim(request.getParameter("TARGET"));
if (target == null) {
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPPostDecoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPPostDecoder.java
index 6b1cec86c..0dfeb72cb 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPPostDecoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPPostDecoder.java
@@ -33,12 +33,12 @@ import org.opensaml.saml.common.messaging.context.SAMLBindingContext;
import org.opensaml.saml.common.xml.SAMLConstants;
import org.opensaml.saml.saml1.core.ResponseAbstractType;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import jakarta.servlet.http.HttpServletRequest;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.codec.Base64Support;
import net.shibboleth.shared.codec.DecodingException;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* SAML 1.X HTTP POST message decoder.
@@ -78,7 +78,8 @@ public class HTTPPostDecoder extends BaseHttpServletRequestXMLMessageDecoder imp
protected void doDecode() throws MessageDecodingException {
final MessageContext messageContext = new MessageContext();
final HttpServletRequest request = getHttpServletRequest();
-
+ assert request != null;
+
if (!"POST".equalsIgnoreCase(request.getMethod())) {
throw new MessageDecodingException("This message decoder only supports the HTTP POST method");
}
@@ -89,7 +90,10 @@ public class HTTPPostDecoder extends BaseHttpServletRequestXMLMessageDecoder imp
try {
final String base64Message = request.getParameter("SAMLResponse");
- final byte[] decodedBytes = Base64Support.decode(base64Message);
+ if (base64Message == null) {
+ throw new MessageDecodingException("Missing SAMLResponse parameter");
+ }
+ final byte[] decodedBytes = Base64Support.decode(base64Message);
final SAMLObject inboundMessage = (SAMLObject) unmarshallMessage(new ByteArrayInputStream(decodedBytes));
messageContext.setMessage(inboundMessage);
@@ -117,4 +121,4 @@ public class HTTPPostDecoder extends BaseHttpServletRequestXMLMessageDecoder imp
messageContext.getMessage() instanceof ResponseAbstractType);
}
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPSOAP11Decoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPSOAP11Decoder.java
index f455f0f42..d27c323a3 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPSOAP11Decoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPSOAP11Decoder.java
@@ -29,9 +29,9 @@ import org.opensaml.saml.common.binding.impl.SAMLSOAPDecoderBodyHandler;
import org.opensaml.saml.common.messaging.context.SAMLBindingContext;
import org.opensaml.saml.common.xml.SAMLConstants;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* SAML 1.1 HTTP SOAP 1.1 binding decoder.
@@ -79,9 +79,12 @@ public class HTTPSOAP11Decoder extends org.opensaml.soap.soap11.decoder.http.imp
protected void doDecode() throws MessageDecodingException {
super.doDecode();
- populateBindingContext(getMessageContext());
+ final MessageContext msgCtx = getMessageContext();
+ assert msgCtx != null;
- final Object samlMessage = getMessageContext().getMessage();
+ populateBindingContext(msgCtx);
+
+ final Object samlMessage = msgCtx.getMessage();
if (samlMessage instanceof SAMLObject) {
log.debug("Decoded SOAP messaged which included SAML message of type {}",
((SAMLObject) samlMessage).getElementQName());
@@ -95,7 +98,7 @@ public class HTTPSOAP11Decoder extends org.opensaml.soap.soap11.decoder.http.imp
*
* @param messageContext the current message context
*/
- protected void populateBindingContext(final MessageContext messageContext) {
+ protected void populateBindingContext(@Nonnull final MessageContext messageContext) {
final SAMLBindingContext bindingContext = messageContext.ensureSubcontext(SAMLBindingContext.class);
bindingContext.setBindingUri(getBindingURI());
bindingContext.setBindingDescriptor(bindingDescriptor);
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HttpClientResponseSOAP11Decoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HttpClientResponseSOAP11Decoder.java
index 08b0ab76e..2d5edcb60 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HttpClientResponseSOAP11Decoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HttpClientResponseSOAP11Decoder.java
@@ -29,9 +29,9 @@ import org.opensaml.saml.common.binding.impl.SAMLSOAPDecoderBodyHandler;
import org.opensaml.saml.common.messaging.context.SAMLBindingContext;
import org.opensaml.saml.common.xml.SAMLConstants;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* SAML 1.1 HTTP SOAP 1.1 binding decoder for HttpClient HttpResponse.
@@ -80,9 +80,12 @@ public class HttpClientResponseSOAP11Decoder
protected void doDecode() throws MessageDecodingException {
super.doDecode();
- populateBindingContext(getMessageContext());
+ final MessageContext msgCtx = getMessageContext();
+ assert msgCtx != null;
- final Object samlMessage = getMessageContext().getMessage();
+ populateBindingContext(msgCtx);
+
+ final Object samlMessage = msgCtx.getMessage();
if (samlMessage instanceof SAMLObject) {
log.debug("Decoded SOAP message which included SAML message of type {}",
((SAMLObject) samlMessage).getElementQName());
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/HTTPArtifactEncoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/HTTPArtifactEncoder.java
index d7a306913..f35490ad2 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/HTTPArtifactEncoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/HTTPArtifactEncoder.java
@@ -35,11 +35,11 @@ import org.opensaml.saml.common.xml.SAMLConstants;
import org.opensaml.saml.config.SAMLConfigurationSupport;
import org.opensaml.saml.saml1.binding.artifact.SAML1Artifact;
import org.opensaml.saml.saml1.binding.artifact.SAML1ArtifactBuilder;
+import org.opensaml.saml.saml1.binding.artifact.SAML1ArtifactBuilderFactory;
import org.opensaml.saml.saml1.binding.artifact.SAML1ArtifactType0001;
import org.opensaml.saml.saml1.core.Assertion;
import org.opensaml.saml.saml1.core.Response;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import jakarta.servlet.http.HttpServletResponse;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
@@ -50,6 +50,7 @@ import net.shibboleth.shared.collection.Pair;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.net.URLBuilder;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* SAML 1.X HTTP Artifact message encoder.
@@ -72,7 +73,7 @@ public class HTTPArtifactEncoder extends BaseSAML1MessageEncoder {
/** {@inheritDoc} */
@Override
- public String getBindingURI() {
+ @Nonnull public String getBindingURI() {
return SAMLConstants.SAML1_ARTIFACT_BINDING_URI;
}
@@ -106,14 +107,6 @@ public class HTTPArtifactEncoder extends BaseSAML1MessageEncoder {
}
}
- /** {@inheritDoc} */
- @Override
- protected void doDestroy() {
- artifactMap = null;
-
- super.doDestroy();
- }
-
// Checkstyle: CyclomaticComplexity|MethodLength OFF
/** {@inheritDoc} */
@Override
@@ -152,15 +145,23 @@ public class HTTPArtifactEncoder extends BaseSAML1MessageEncoder {
final SAML1ArtifactBuilder<?> artifactBuilder;
final byte[] artifactType = getSAMLArtifactType(messageContext);
if (artifactType != null) {
- artifactBuilder = SAMLConfigurationSupport.getSAML1ArtifactBuilderFactory()
- .getArtifactBuilder(artifactType);
+ final SAML1ArtifactBuilderFactory artifactBuilderFactory =
+ SAMLConfigurationSupport.getSAML1ArtifactBuilderFactory();
+ artifactBuilder = artifactBuilderFactory != null
+ ? artifactBuilderFactory.getArtifactBuilder(artifactType) : null;
} else {
- artifactBuilder = SAMLConfigurationSupport.getSAML1ArtifactBuilderFactory()
- .getArtifactBuilder(defaultArtifactType);
+ final SAML1ArtifactBuilderFactory artifactBuilderFactory =
+ SAMLConfigurationSupport.getSAML1ArtifactBuilderFactory();
+ artifactBuilder = artifactBuilderFactory != null
+ ? artifactBuilderFactory.getArtifactBuilder(defaultArtifactType) : null;
storeSAMLArtifactType(messageContext, defaultArtifactType);
}
-
+ if (artifactBuilder == null) {
+ throw new MessageEncodingException("Unable to obtain SAML1ArtifactBuilder");
+ }
+
for (final Assertion assertion : samlResponse.getAssertions()) {
+ assert assertion != null;
final SAML1Artifact artifact = artifactBuilder.buildArtifact(messageContext, assertion);
if (artifact == null) {
log.error("Unable to build artifact for message to relying party {}", requester);
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/HTTPPostEncoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/HTTPPostEncoder.java
index 73d0fea83..5c5485a94 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/HTTPPostEncoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/HTTPPostEncoder.java
@@ -22,6 +22,7 @@ import java.io.UnsupportedEncodingException;
import java.io.Writer;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.apache.velocity.VelocityContext;
import org.apache.velocity.app.VelocityEngine;
@@ -32,13 +33,14 @@ import org.opensaml.saml.common.SAMLObject;
import org.opensaml.saml.common.binding.SAMLBindingSupport;
import org.opensaml.saml.common.xml.SAMLConstants;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.codec.Base64Support;
import net.shibboleth.shared.codec.EncodingException;
import net.shibboleth.shared.codec.HTMLEncoder;
import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.servlet.HttpServletSupport;
import net.shibboleth.shared.xml.SerializeSupport;
@@ -53,22 +55,21 @@ public class HTTPPostEncoder extends BaseSAML1MessageEncoder {
@Nonnull @NotEmpty public static final String DEFAULT_TEMPLATE_ID = "/templates/saml1-post-binding.vm";
/** Class logger. */
- private final Logger log = LoggerFactory.getLogger(HTTPPostEncoder.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(HTTPPostEncoder.class);
/** Velocity engine used to evaluate the template when performing POST encoding. */
- private VelocityEngine velocityEngine;
+ @NonnullAfterInit private VelocityEngine velocityEngine;
/** ID of the velocity template used when performing POST encoding. */
- private String velocityTemplateId;
+ @NonnullAfterInit private String velocityTemplateId;
/** Constructor. */
public HTTPPostEncoder() {
- super();
setVelocityTemplateId(DEFAULT_TEMPLATE_ID);
}
/** {@inheritDoc} */
- public String getBindingURI() {
+ @Nonnull public String getBindingURI() {
return SAMLConstants.SAML1_POST_BINDING_URI;
}
@@ -77,7 +78,7 @@ public class HTTPPostEncoder extends BaseSAML1MessageEncoder {
*
* @return return the VelocityEngine instance
*/
- public VelocityEngine getVelocityEngine() {
+ @NonnullAfterInit public VelocityEngine getVelocityEngine() {
return velocityEngine;
}
@@ -86,7 +87,7 @@ public class HTTPPostEncoder extends BaseSAML1MessageEncoder {
*
* @param newVelocityEngine the new VelocityEngine instane
*/
- public void setVelocityEngine(final VelocityEngine newVelocityEngine) {
+ public void setVelocityEngine(@Nullable final VelocityEngine newVelocityEngine) {
checkSetterPreconditions();
velocityEngine = newVelocityEngine;
}
@@ -98,7 +99,7 @@ public class HTTPPostEncoder extends BaseSAML1MessageEncoder {
*
* @return return the Velocity template id
*/
- public String getVelocityTemplateId() {
+ @NonnullAfterInit public String getVelocityTemplateId() {
return velocityTemplateId;
}
@@ -109,18 +110,11 @@ public class HTTPPostEncoder extends BaseSAML1MessageEncoder {
*
* @param newVelocityTemplateId the new Velocity template id
*/
- public void setVelocityTemplateId(final String newVelocityTemplateId) {
+ public void setVelocityTemplateId(@Nullable final String newVelocityTemplateId) {
checkSetterPreconditions();
velocityTemplateId = newVelocityTemplateId;
}
- /** {@inheritDoc} */
- protected void doDestroy() {
- velocityEngine = null;
- velocityTemplateId = null;
- super.doDestroy();
- }
-
/** {@inheritDoc} */
protected void doInitialize() throws ComponentInitializationException {
super.doInitialize();
@@ -153,13 +147,14 @@ public class HTTPPostEncoder extends BaseSAML1MessageEncoder {
*
* @throws MessageEncodingException thrown if there is a problem encoding the message
*/
- protected void postEncode(final MessageContext messageContext, final String endpointURL)
+ protected void postEncode(@Nonnull final MessageContext messageContext, @Nonnull final String endpointURL)
throws MessageEncodingException {
log.debug("Invoking velocity template to create POST body");
try {
final VelocityContext context = new VelocityContext();
- final Object message = messageContext.getMessage();
+ final XMLObject message = (XMLObject) messageContext.getMessage();
+ assert message != null;
final String encodedEndpointURL = HTMLEncoder.encodeForHTMLAttribute(endpointURL);
log.debug("Encoding action url of '{}' with encoded value '{}'", endpointURL, encodedEndpointURL);
@@ -167,7 +162,7 @@ public class HTTPPostEncoder extends BaseSAML1MessageEncoder {
context.put("binding", getBindingURI());
log.debug("Marshalling and Base64 encoding SAML message");
- final String messageXML = SerializeSupport.nodeToString(marshallMessage((XMLObject) message));
+ final String messageXML = SerializeSupport.nodeToString(marshallMessage(message));
final String encodedMessage = Base64Support.encode(messageXML.getBytes("UTF-8"), Base64Support.UNCHUNKED);
context.put("SAMLResponse", encodedMessage);
@@ -179,7 +174,8 @@ public class HTTPPostEncoder extends BaseSAML1MessageEncoder {
}
final HttpServletResponse response = getHttpServletResponse();
-
+ assert response != null;
+
HttpServletSupport.addNoCacheHeaders(response);
HttpServletSupport.setUTF8Encoding(response);
HttpServletSupport.setContentType(response, "text/html");
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/HTTPSOAP11Encoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/HTTPSOAP11Encoder.java
index 67a989ce5..a397ca3c6 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/HTTPSOAP11Encoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/HTTPSOAP11Encoder.java
@@ -17,6 +17,9 @@
package org.opensaml.saml.saml1.binding.encoding.impl;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.opensaml.saml.common.binding.encoding.SAMLMessageEncoder;
import org.opensaml.saml.common.xml.SAMLConstants;
@@ -28,13 +31,13 @@ public class HTTPSOAP11Encoder extends org.opensaml.soap.soap11.encoder.http.imp
/** {@inheritDoc} */
@Override
- protected String getSOAPAction() {
+ @Nullable protected String getSOAPAction() {
return "http://www.oasis-open.org/committees/security";
}
/** {@inheritDoc} */
@Override
- public String getBindingURI() {
+ @Nonnull public String getBindingURI() {
return SAMLConstants.SAML1_SOAP11_BINDING_URI;
}
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/HttpClientRequestSOAP11Encoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/HttpClientRequestSOAP11Encoder.java
index 940032634..eb7a34494 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/HttpClientRequestSOAP11Encoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/HttpClientRequestSOAP11Encoder.java
@@ -17,25 +17,28 @@
package org.opensaml.saml.saml1.binding.encoding.impl;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.opensaml.saml.common.binding.encoding.SAMLMessageEncoder;
import org.opensaml.saml.common.xml.SAMLConstants;
/**
* SAML 1.X HTTP SOAP 1.1 binding message encoder for HttpClient HttpRequest.
*/
-public class HttpClientRequestSOAP11Encoder
+public class HttpClientRequestSOAP11Encoder
extends org.opensaml.soap.client.soap11.encoder.http.impl.HttpClientRequestSOAP11Encoder
implements SAMLMessageEncoder {
/** {@inheritDoc} */
@Override
- protected String getSOAPAction() {
+ @Nullable protected String getSOAPAction() {
return "http://www.oasis-open.org/committees/security";
}
/** {@inheritDoc} */
@Override
- public String getBindingURI() {
+ @Nonnull public String getBindingURI() {
return SAMLConstants.SAML1_SOAP11_BINDING_URI;
}
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/impl/SAML1ArtifactRequestIssuerHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/impl/SAML1ArtifactRequestIssuerHandler.java
index d1275a404..903e0a0c1 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/impl/SAML1ArtifactRequestIssuerHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/impl/SAML1ArtifactRequestIssuerHandler.java
@@ -24,6 +24,7 @@ import javax.annotation.Nonnull;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.AbstractMessageHandler;
@@ -33,7 +34,7 @@ import org.opensaml.saml.common.binding.artifact.SAMLArtifactMap.SAMLArtifactMap
import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
import org.opensaml.saml.saml1.core.Request;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
/**
* SAML {@link org.opensaml.messaging.handler.MessageHandler} that addresses the SAML 1.x
@@ -70,7 +71,6 @@ public class SAML1ArtifactRequestIssuerHandler extends AbstractMessageHandler {
}
}
-// Checkstyle: ReturnCount OFF
/** {@inheritDoc} */
@Override
protected void doInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
@@ -81,12 +81,18 @@ public class SAML1ArtifactRequestIssuerHandler extends AbstractMessageHandler {
}
final Request request = (Request) messageContext.getMessage();
+ assert request != null;
if (request.getAssertionArtifacts().isEmpty()) {
log.trace("{} Request did not contain any artifacts", getLogPrefix());
return;
}
final String artifact = request.getAssertionArtifacts().get(0).getValue();
+ if (artifact == null) {
+ log.trace("{} Request did not contain any artifacts", getLogPrefix());
+ return;
+ }
+
try {
final SAMLArtifactMapEntry entry = artifactMap.get(artifact);
if (entry == null) {
@@ -101,6 +107,5 @@ public class SAML1ArtifactRequestIssuerHandler extends AbstractMessageHandler {
log.error("{} Error resolving first artifact in request: {}", getLogPrefix(), artifact, e);
}
}
-// Checkstyle: ReturnCount ON
}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidator.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidator.java
index 0a2f635d2..7037a2c46 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidator.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidator.java
@@ -32,9 +32,10 @@ import org.opensaml.saml.saml2.assertion.SAML2AssertionValidationParameters;
import org.opensaml.saml.saml2.assertion.SubjectConfirmationValidator;
import org.opensaml.saml.saml2.core.Assertion;
import org.opensaml.saml.saml2.core.SubjectConfirmation;
+import org.opensaml.saml.saml2.core.SubjectConfirmationData;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.ObjectSupport;
import net.shibboleth.shared.primitive.StringSupport;
@@ -100,11 +101,7 @@ import net.shibboleth.shared.primitive.StringSupport;
public abstract class AbstractSubjectConfirmationValidator implements SubjectConfirmationValidator {
/** Class logger. */
- private Logger log = LoggerFactory.getLogger(AbstractSubjectConfirmationValidator.class);
-
- /** Constructor. */
- public AbstractSubjectConfirmationValidator() {
- }
+ @Nonnull private Logger log = LoggerFactory.getLogger(AbstractSubjectConfirmationValidator.class);
/** {@inheritDoc} */
// Checkstyle: CyclomaticComplexity OFF
@@ -118,28 +115,29 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
final boolean notOnOrAfterRequired = isNotOnOrAfterRequired(context);
final boolean notBeforeRequired = isNotBeforeRequired(context);
- if (confirmation.getSubjectConfirmationData() != null) {
- ValidationResult result = validateNotBefore(confirmation, assertion, context, notBeforeRequired);
+ final SubjectConfirmationData confirmationData = confirmation.getSubjectConfirmationData();
+ if (confirmationData != null) {
+ ValidationResult result = validateNotBefore(confirmationData, assertion, context, notBeforeRequired);
if (result != ValidationResult.VALID) {
return result;
}
- result = validateNotOnOrAfter(confirmation, assertion, context, notOnOrAfterRequired);
+ result = validateNotOnOrAfter(confirmationData, assertion, context, notOnOrAfterRequired);
if (result != ValidationResult.VALID) {
return result;
}
- result = validateRecipient(confirmation, assertion, context, recipientRequired);
+ result = validateRecipient(confirmationData, assertion, context, recipientRequired);
if (result != ValidationResult.VALID) {
return result;
}
- result = validateAddress(confirmation, assertion, context, addressRequired);
+ result = validateAddress(confirmationData, assertion, context, addressRequired);
if (result != ValidationResult.VALID) {
return result;
}
- result = validateInResponseTo(confirmation, assertion, context, inResponseToRequired);
+ result = validateInResponseTo(confirmationData, assertion, context, inResponseToRequired);
if (result != ValidationResult.VALID) {
return result;
}
@@ -165,10 +163,11 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
* @return true if required, false if not
*/
protected boolean isAddressRequired(final ValidationContext context) {
- return ObjectSupport.firstNonNull(
+ final Boolean flag = ObjectSupport.firstNonNull(
(Boolean) context.getStaticParameters().get(
SAML2AssertionValidationParameters.SC_ADDRESS_REQUIRED),
Boolean.FALSE);
+ return flag != null ? flag : false;
}
/**
@@ -179,10 +178,11 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
* @return true if required, false if not
*/
protected boolean isRecipientRequired(final ValidationContext context) {
- return ObjectSupport.firstNonNull(
+ final Boolean flag = ObjectSupport.firstNonNull(
(Boolean) context.getStaticParameters().get(
SAML2AssertionValidationParameters.SC_RECIPIENT_REQUIRED),
Boolean.FALSE);
+ return flag != null ? flag : false;
}
/**
@@ -193,10 +193,11 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
* @return true if required, false if not
*/
protected boolean isNotBeforeRequired(final ValidationContext context) {
- return ObjectSupport.firstNonNull(
+ final Boolean flag = ObjectSupport.firstNonNull(
(Boolean) context.getStaticParameters().get(
SAML2AssertionValidationParameters.SC_NOT_BEFORE_REQUIRED),
Boolean.FALSE);
+ return flag != null ? flag : false;
}
/**
@@ -207,10 +208,11 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
* @return true if required, false if not
*/
protected boolean isNotOnOrAfterRequired(final ValidationContext context) {
- return ObjectSupport.firstNonNull(
+ final Boolean flag = ObjectSupport.firstNonNull(
(Boolean) context.getStaticParameters().get(
SAML2AssertionValidationParameters.SC_NOT_ON_OR_AFTER_REQUIRED),
Boolean.FALSE);
+ return flag != null ? flag : false;
}
/**
@@ -221,18 +223,17 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
* @return true if required, false if not
*/
protected boolean isInResponseToRequired(final ValidationContext context) {
- return ObjectSupport.firstNonNull(
+ final Boolean flag = ObjectSupport.firstNonNull(
(Boolean) context.getStaticParameters().get(
SAML2AssertionValidationParameters.SC_IN_RESPONSE_TO_REQUIRED),
Boolean.FALSE);
+ return flag != null ? flag : false;
}
/**
- * Validates the <code>InResponseTo</code> condition of the
- * {@link org.opensaml.saml.saml2.core.SubjectConfirmationData}, if any is present.
+ * Validates the <code>InResponseTo</code> condition of the {@link SubjectConfirmationData}, if any is present.
*
- * @param confirmation confirmation method, with {@link org.opensaml.saml.saml2.core.SubjectConfirmationData},
- * being validated
+ * @param confirmationData confirmation data being validated
* @param assertion assertion bearing the confirmation method
* @param context current validation context
* @param required whether the InResponseTo value is required
@@ -241,12 +242,12 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
*
* @throws AssertionValidationException thrown if there is a problem determining the validity of the NotBefore
*/
- protected ValidationResult validateInResponseTo(@Nonnull final SubjectConfirmation confirmation,
+ @Nonnull protected ValidationResult validateInResponseTo(@Nonnull final SubjectConfirmationData confirmationData,
@Nonnull final Assertion assertion, @Nonnull final ValidationContext context, final boolean required)
throws AssertionValidationException {
final String inResponseTo =
- StringSupport.trimOrNull(confirmation.getSubjectConfirmationData().getInResponseTo());
+ StringSupport.trimOrNull(confirmationData.getInResponseTo());
if (inResponseTo == null) {
if (required) {
log.warn("SubjectConfirmationData/@InResponseTo was missing and was required");
@@ -291,11 +292,9 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
}
/**
- * Validates the <code>NotBefore</code> condition of the
- * {@link org.opensaml.saml.saml2.core.SubjectConfirmationData}, if any is present.
+ * Validates the <code>NotBefore</code> condition of the {@link SubjectConfirmationData}, if any is present.
*
- * @param confirmation confirmation method, with {@link org.opensaml.saml.saml2.core.SubjectConfirmationData},
- * being validated
+ * @param confirmationData confirmation data being validated
* @param assertion assertion bearing the confirmation method
* @param context current validation context
* @param required whether the NotBefore value is required
@@ -304,11 +303,11 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
*
* @throws AssertionValidationException thrown if there is a problem determining the validity of the NotBefore
*/
- @Nonnull protected ValidationResult validateNotBefore(@Nonnull final SubjectConfirmation confirmation,
+ @Nonnull protected ValidationResult validateNotBefore(@Nonnull final SubjectConfirmationData confirmationData,
@Nonnull final Assertion assertion, @Nonnull final ValidationContext context,
final boolean required) throws AssertionValidationException {
- final Instant notBefore = confirmation.getSubjectConfirmationData().getNotBefore();
+ final Instant notBefore = confirmationData.getNotBefore();
if (notBefore == null) {
if (required) {
log.warn("SubjectConfirmationData/@NotBefore was missing and was required");
@@ -334,11 +333,9 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
}
/**
- * Validates the <code>NotOnOrAfter</code> condition of the
- * {@link org.opensaml.saml.saml2.core.SubjectConfirmationData}, if any is present.
+ * Validates the <code>NotOnOrAfter</code> condition of the {@link SubjectConfirmationData}, if any is present.
*
- * @param confirmation confirmation method, with {@link org.opensaml.saml.saml2.core.SubjectConfirmationData},
- * being validated
+ * @param confirmationData confirmation data being validated
* @param assertion assertion bearing the confirmation method
* @param context current validation context
* @param required whether the NotOnOrAfter value is required
@@ -347,11 +344,11 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
*
* @throws AssertionValidationException thrown if there is a problem determining the validity of the NotOnOrAFter
*/
- @Nonnull protected ValidationResult validateNotOnOrAfter(@Nonnull final SubjectConfirmation confirmation,
+ @Nonnull protected ValidationResult validateNotOnOrAfter(@Nonnull final SubjectConfirmationData confirmationData,
@Nonnull final Assertion assertion, @Nonnull final ValidationContext context, final boolean required)
throws AssertionValidationException {
- final Instant notOnOrAfter = confirmation.getSubjectConfirmationData().getNotOnOrAfter();
+ final Instant notOnOrAfter = confirmationData.getNotOnOrAfter();
if (notOnOrAfter == null) {
if (required) {
log.warn("SubjectConfirmationData/@NotOnOrAfter was missing and was required");
@@ -377,10 +374,9 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
}
/**
- * Validates the <code>Recipient</code> condition of the
- * {@link org.opensaml.saml.saml2.core.SubjectConfirmationData}, if any is present.
+ * Validates the <code>Recipient</code> condition of the {@link SubjectConfirmationData}, if any is present.
*
- * @param confirmation confirmation method being validated
+ * @param confirmationData confirmation data being validated
* @param assertion assertion bearing the confirmation method
* @param context current validation context
* @param required whether the Recipient value is required
@@ -389,12 +385,12 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
*
* @throws AssertionValidationException thrown if there is a problem determining the validity of the recipient
*/
- @Nonnull protected ValidationResult validateRecipient(@Nonnull final SubjectConfirmation confirmation,
+ @Nonnull protected ValidationResult validateRecipient(@Nonnull final SubjectConfirmationData confirmationData,
@Nonnull final Assertion assertion, @Nonnull final ValidationContext context, final boolean required)
throws AssertionValidationException {
final String recipient =
- StringSupport.trimOrNull(confirmation.getSubjectConfirmationData().getRecipient());
+ StringSupport.trimOrNull(confirmationData.getRecipient());
if (recipient == null) {
if (required) {
log.warn("SubjectConfirmationData/@Recipient was missing and was required");
@@ -441,10 +437,9 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
}
/**
- * Validates the <code>Address</code> condition of the {@link org.opensaml.saml.saml2.core.SubjectConfirmationData},
- * if any is present.
+ * Validates the <code>Address</code> condition of the {@link SubjectConfirmationData}, if any is present.
*
- * @param confirmation confirmation method being validated
+ * @param confirmationData confirmation data being validated
* @param assertion assertion bearing the confirmation method
* @param context current validation context
* @param required whether the Address value is required
@@ -453,7 +448,7 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
*
* @throws AssertionValidationException thrown if there is a problem determining the validity of the address
*/
- @Nonnull protected ValidationResult validateAddress(@Nonnull final SubjectConfirmation confirmation,
+ @Nonnull protected ValidationResult validateAddress(@Nonnull final SubjectConfirmationData confirmationData,
@Nonnull final Assertion assertion, @Nonnull final ValidationContext context, final boolean required)
throws AssertionValidationException {
@@ -465,7 +460,7 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
return ValidationResult.VALID;
}
- final String address = StringSupport.trimOrNull(confirmation.getSubjectConfirmationData().getAddress());
+ final String address = StringSupport.trimOrNull(confirmationData.getAddress());
if (address == null) {
if (required) {
log.warn("SubjectConfirmationData/@Address was missing and was required");
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AuthnStatementValidator.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AuthnStatementValidator.java
index 450978de5..c9e790424 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AuthnStatementValidator.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AuthnStatementValidator.java
@@ -35,8 +35,8 @@ import org.opensaml.saml.saml2.core.AuthnStatement;
import org.opensaml.saml.saml2.core.Statement;
import org.opensaml.saml.saml2.core.SubjectLocality;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -72,15 +72,15 @@ import net.shibboleth.shared.primitive.StringSupport;
public class AuthnStatementValidator implements StatementValidator {
/** Logger. */
- private Logger log = LoggerFactory.getLogger(AuthnStatementValidator.class);
+ @Nonnull private Logger log = LoggerFactory.getLogger(AuthnStatementValidator.class);
/** {@inheritDoc} */
- public QName getServicedStatement() {
+ @Nonnull public QName getServicedStatement() {
return AuthnStatement.DEFAULT_ELEMENT_NAME;
}
/** {@inheritDoc} */
- public ValidationResult validate(@Nonnull final Statement statement, @Nonnull final Assertion assertion,
+ @Nonnull public ValidationResult validate(@Nonnull final Statement statement, @Nonnull final Assertion assertion,
@Nonnull final ValidationContext context) throws AssertionValidationException {
if (!(statement instanceof AuthnStatement)) {
@@ -126,7 +126,7 @@ public class AuthnStatementValidator implements StatementValidator {
*
* @throws AssertionValidationException if there is a fatal error during evaluation
*/
- protected ValidationResult validateAuthnInstant(@Nonnull final AuthnStatement authnStatement,
+ @Nonnull protected ValidationResult validateAuthnInstant(@Nonnull final AuthnStatement authnStatement,
@Nonnull final Assertion assertion, @Nonnull final ValidationContext context)
throws AssertionValidationException {
@@ -169,7 +169,7 @@ public class AuthnStatementValidator implements StatementValidator {
*
* @throws AssertionValidationException if there is a fatal error during evaluation
*/
- protected ValidationResult validateSubjectLocality(@Nonnull final AuthnStatement authnStatement,
+ @Nonnull protected ValidationResult validateSubjectLocality(@Nonnull final AuthnStatement authnStatement,
@Nonnull final Assertion assertion, @Nonnull final ValidationContext context)
throws AssertionValidationException {
@@ -210,7 +210,7 @@ public class AuthnStatementValidator implements StatementValidator {
*
* @throws AssertionValidationException if there is a fatal error during evaluation
*/
- protected ValidationResult validateAuthnContext(@Nonnull final AuthnStatement authnStatement,
+ @Nonnull protected ValidationResult validateAuthnContext(@Nonnull final AuthnStatement authnStatement,
@Nonnull final Assertion assertion, @Nonnull final ValidationContext context)
throws AssertionValidationException {
// Default is no-op.
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/DelegationRestrictionConditionValidator.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/DelegationRestrictionConditionValidator.java
index da4b31163..c070db951 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/DelegationRestrictionConditionValidator.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/DelegationRestrictionConditionValidator.java
@@ -67,7 +67,7 @@ public class DelegationRestrictionConditionValidator implements ConditionValidat
@Nonnull public ValidationResult validate(@Nonnull final Condition condition, @Nonnull final Assertion assertion,
@Nonnull final ValidationContext context) throws AssertionValidationException {
- if ((condition instanceof DelegationRestrictionType)
+ if (condition instanceof DelegationRestrictionType
|| Objects.equals(condition.getSchemaType(), DelegationRestrictionType.TYPE_NAME)) {
// Delegation restriction information is a 'condition of use' type condition so we always return valid.
return ValidationResult.VALID;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/HolderOfKeySubjectConfirmationValidator.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/HolderOfKeySubjectConfirmationValidator.java
index d2c9f92f5..6b68a6259 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/HolderOfKeySubjectConfirmationValidator.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/HolderOfKeySubjectConfirmationValidator.java
@@ -31,6 +31,7 @@ import javax.xml.namespace.QName;
import net.shibboleth.shared.collection.LazyList;
import net.shibboleth.shared.collection.Pair;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.core.xml.XMLObject;
import org.opensaml.saml.common.assertion.AssertionValidationException;
@@ -47,7 +48,6 @@ import org.opensaml.xmlsec.signature.KeyInfo;
import org.opensaml.xmlsec.signature.KeyValue;
import org.opensaml.xmlsec.signature.X509Data;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* Validates a Holder of Key subject confirmation.
@@ -108,13 +108,14 @@ import org.slf4j.LoggerFactory;
public class HolderOfKeySubjectConfirmationValidator extends AbstractSubjectConfirmationValidator {
/** Class logger. */
- private Logger log = LoggerFactory.getLogger(HolderOfKeySubjectConfirmationValidator.class);
+ @Nonnull private Logger log = LoggerFactory.getLogger(HolderOfKeySubjectConfirmationValidator.class);
/** {@inheritDoc} */
@Nonnull public String getServicedMethod() {
return SubjectConfirmation.METHOD_HOLDER_OF_KEY;
}
+// Checkstyle: CyclomaticComplexity|ReturnCount OFF
/** {@inheritDoc} */
@Nonnull protected ValidationResult doValidate(@Nonnull final SubjectConfirmation confirmation,
@Nonnull final Assertion assertion, @Nonnull final ValidationContext context)
@@ -124,8 +125,13 @@ public class HolderOfKeySubjectConfirmationValidator extends AbstractSubjectConf
return ValidationResult.INDETERMINATE;
}
+ final SubjectConfirmationData confirmationData = confirmation.getSubjectConfirmationData();
+ if (confirmationData == null) {
+ return ValidationResult.INDETERMINATE;
+ }
+
log.debug("Attempting holder-of-key subject confirmation");
- if (!isValidConfirmationDataType(confirmation)) {
+ if (!isValidConfirmationDataType(confirmationData)) {
final String msg = String.format(
"Subject confirmation data is not of type '%s'", KeyInfoConfirmationDataType.TYPE_NAME);
log.debug(msg);
@@ -133,7 +139,7 @@ public class HolderOfKeySubjectConfirmationValidator extends AbstractSubjectConf
return ValidationResult.INVALID;
}
- final List<KeyInfo> possibleKeys = getSubjectConfirmationKeyInformation(confirmation, assertion, context);
+ final List<KeyInfo> possibleKeys = getSubjectConfirmationKeyInformation(confirmationData, assertion, context);
if (possibleKeys.isEmpty()) {
final String msg = String.format(
"No key information for holder of key subject confirmation in assertion '%s'", assertion.getID());
@@ -158,6 +164,7 @@ public class HolderOfKeySubjectConfirmationValidator extends AbstractSubjectConf
}
for (final KeyInfo keyInfo : possibleKeys) {
+ assert keyInfo != null;
if (matchesKeyValue(keyCertPair.getFirst(), keyInfo)) {
log.debug("Successfully matched public key in subject confirmation data to supplied key param");
context.getDynamicParameters().put(SAML2AssertionValidationParameters.SC_HOK_CONFIRMED_KEYINFO,
@@ -173,20 +180,21 @@ public class HolderOfKeySubjectConfirmationValidator extends AbstractSubjectConf
return ValidationResult.INVALID;
}
+// Checkstyle: CyclomaticComplexity|ReturnCount ON
/**
* Checks to see whether the schema type of the subject confirmation data, if present, is the required
* {@link KeyInfoConfirmationDataType#TYPE_NAME}.
*
- * @param confirmation subject confirmation bearing the confirmation data to be checked
+ * @param confirmationData subject confirmation data to be checked
*
* @return true if the confirmation data's schema type is correct, false otherwise
*
* @throws AssertionValidationException thrown if there is a problem validating the confirmation data type
*/
- protected boolean isValidConfirmationDataType(@Nonnull final SubjectConfirmation confirmation)
+ protected boolean isValidConfirmationDataType(@Nonnull final SubjectConfirmationData confirmationData)
throws AssertionValidationException {
- final QName confirmationDataSchemaType = confirmation.getSubjectConfirmationData().getSchemaType();
+ final QName confirmationDataSchemaType = confirmationData.getSchemaType();
if (confirmationDataSchemaType != null
&& !confirmationDataSchemaType.equals(KeyInfoConfirmationDataType.TYPE_NAME)) {
log.debug("SubjectConfirmationData xsi:type was non-null and did not match {}",
@@ -248,7 +256,7 @@ public class HolderOfKeySubjectConfirmationValidator extends AbstractSubjectConf
/**
* Extracts the {@link KeyInfo}s from the given subject confirmation data.
*
- * @param confirmation subject confirmation data
+ * @param confirmationData subject confirmation data
* @param assertion assertion bearing the subject to be confirmed
* @param context current message processing context
*
@@ -258,11 +266,9 @@ public class HolderOfKeySubjectConfirmationValidator extends AbstractSubjectConf
*
*/
@Nonnull protected List<KeyInfo> getSubjectConfirmationKeyInformation(
- @Nonnull final SubjectConfirmation confirmation, @Nonnull final Assertion assertion,
+ @Nonnull final SubjectConfirmationData confirmationData, @Nonnull final Assertion assertion,
@Nonnull final ValidationContext context) throws AssertionValidationException {
- final SubjectConfirmationData confirmationData = confirmation.getSubjectConfirmationData();
-
final List<KeyInfo> keyInfos = new LazyList<>();
for (final XMLObject object : confirmationData.getUnknownXMLObjects(KeyInfo.DEFAULT_ELEMENT_NAME)) {
if (object != null) {
@@ -327,9 +333,9 @@ public class HolderOfKeySubjectConfirmationValidator extends AbstractSubjectConf
*
* @return true if the public key in the certificate matches one of the key values, false otherwise
*/
- protected boolean matchesKeyValue(@Nonnull final PublicKey key, @Nullable final List<KeyValue> keyValues) {
+ protected boolean matchesKeyValue(@Nonnull final PublicKey key, @Nonnull final List<KeyValue> keyValues) {
- if (keyValues == null || keyValues.isEmpty()) {
+ if (keyValues.isEmpty()) {
log.debug("KeyInfo contained no KeyValue children");
return false;
}
@@ -338,6 +344,7 @@ public class HolderOfKeySubjectConfirmationValidator extends AbstractSubjectConf
for (final KeyValue keyValue : keyValues) {
try {
+ assert keyValue != null;
final PublicKey kiPublicKey = KeyInfoSupport.getKey(keyValue);
if (Objects.equals(key, kiPublicKey)) {
log.debug("Matched KeyValue PublicKey");
@@ -367,9 +374,9 @@ public class HolderOfKeySubjectConfirmationValidator extends AbstractSubjectConf
* @return true if the public key in the certificate matches one of the DER-encoded key values, false otherwise
*/
protected boolean matchesDEREncodedKeyValue(@Nonnull final PublicKey key,
- @Nullable final List<DEREncodedKeyValue> derEncodedKeyValues) {
+ @Nonnull final List<DEREncodedKeyValue> derEncodedKeyValues) {
- if (derEncodedKeyValues == null || derEncodedKeyValues.isEmpty()) {
+ if (derEncodedKeyValues.isEmpty()) {
log.debug("KeyInfo contained no DEREncodedKeyValue children");
return false;
}
@@ -379,6 +386,7 @@ public class HolderOfKeySubjectConfirmationValidator extends AbstractSubjectConf
for (final DEREncodedKeyValue derEncodedKeyValue : derEncodedKeyValues) {
try {
+ assert derEncodedKeyValue != null;
final PublicKey kiPublicKey = KeyInfoSupport.getKey(derEncodedKeyValue);
if (Objects.equals(key, kiPublicKey)) {
log.debug("Matched DEREncodedKeyValue PublicKey");
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/OneTimeUseConditionValidator.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/OneTimeUseConditionValidator.java
index 707301bf8..a5c7d2cd9 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/OneTimeUseConditionValidator.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/OneTimeUseConditionValidator.java
@@ -28,6 +28,7 @@ import javax.xml.namespace.QName;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
import org.opensaml.saml.common.assertion.AssertionValidationException;
@@ -37,10 +38,10 @@ import org.opensaml.saml.saml2.assertion.ConditionValidator;
import org.opensaml.saml.saml2.assertion.SAML2AssertionValidationParameters;
import org.opensaml.saml.saml2.core.Assertion;
import org.opensaml.saml.saml2.core.Condition;
+import org.opensaml.saml.saml2.core.Issuer;
import org.opensaml.saml.saml2.core.OneTimeUse;
import org.opensaml.storage.ReplayCache;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* {@link ConditionValidator} used for {@link OneTimeUse} conditions.
@@ -76,7 +77,7 @@ public class OneTimeUseConditionValidator implements ConditionValidator {
@Nonnull private final ReplayCache replayCache;
/** Time for disposal of value from cache. */
- @Nonnull private Duration replayCacheExpires;
+ @Nonnull private final Duration replayCacheExpires;
/**
* Constructor.
@@ -87,14 +88,15 @@ public class OneTimeUseConditionValidator implements ConditionValidator {
*/
public OneTimeUseConditionValidator(@Nonnull final ReplayCache replay, @Nullable final Duration expires) {
replayCache = Constraint.isNotNull(replay, "Replay cache was null");
- replayCacheExpires = expires;
- if (replayCacheExpires == null) {
+ if (expires == null) {
+ replayCacheExpires = Duration.ofHours(8);
+ } else if (expires.isNegative()) {
replayCacheExpires = Duration.ofHours(8);
- } else if (replayCacheExpires.isNegative()) {
log.warn("Supplied value for replay cache expires '{}' was negative, using default expiration",
replayCacheExpires);
- replayCacheExpires = Duration.ofHours(8);
+ } else {
+ replayCacheExpires = expires;
}
}
@@ -189,9 +191,11 @@ public class OneTimeUseConditionValidator implements ConditionValidator {
*/
@Nonnull protected String getCacheValue(@Nonnull final Assertion assertion) throws AssertionValidationException {
String issuer = null;
- if (assertion.getIssuer() != null && assertion.getIssuer().getValue() != null) {
- issuer = StringSupport.trimOrNull(assertion.getIssuer().getValue());
+ final Issuer issuerObject = assertion.getIssuer();
+ if (issuerObject != null) {
+ issuer = StringSupport.trimOrNull(issuerObject.getValue());
}
+
if (issuer == null) {
issuer = "NoIssuer";
}
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/ProxyRestrictionConditionValidator.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/ProxyRestrictionConditionValidator.java
index 19f691624..0d6a04be8 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/ProxyRestrictionConditionValidator.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/ProxyRestrictionConditionValidator.java
@@ -67,11 +67,12 @@ public class ProxyRestrictionConditionValidator implements ConditionValidator {
@Nonnull public ValidationResult validate(@Nonnull final Condition condition, @Nonnull final Assertion assertion,
@Nonnull final ValidationContext context) throws AssertionValidationException {
- if ((condition instanceof ProxyRestriction)
+ if (condition instanceof ProxyRestriction
|| Objects.equals(condition.getElementQName(), ProxyRestriction.DEFAULT_ELEMENT_NAME)) {
// Proxy restriction information is a 'condition of use' type condition so we always return valid.
return ValidationResult.VALID;
}
return ValidationResult.INDETERMINATE;
}
+
}
\ No newline at end of file
diff --git a/opensaml-soap-impl/src/main/java/org/opensaml/soap/client/soap11/encoder/http/impl/HttpClientRequestSOAP11Encoder.java b/opensaml-soap-impl/src/main/java/org/opensaml/soap/client/soap11/encoder/http/impl/HttpClientRequestSOAP11Encoder.java
index 2f9ee82f1..67bfe870c 100644
--- a/opensaml-soap-impl/src/main/java/org/opensaml/soap/client/soap11/encoder/http/impl/HttpClientRequestSOAP11Encoder.java
+++ b/opensaml-soap-impl/src/main/java/org/opensaml/soap/client/soap11/encoder/http/impl/HttpClientRequestSOAP11Encoder.java
@@ -220,7 +220,7 @@ public class HttpClientRequestSOAP11Encoder extends BaseHttpClientRequestXMLMess
*
* @return a SOAPAction HTTP header URI value
*/
- protected String getSOAPAction() {
+ @Nullable protected String getSOAPAction() {
final Envelope env = getSOAPEnvelope();
if (env == null) {
return null;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list