[java-identity-provider] branch main updated: OSJ-387: Always use try-with-resources with HttpClient requests ...

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=0d50090ba28ef9b617bd8b1bd9e7d77d8c23ee83

The following commit(s) were added to refs/heads/main by this push:
     new 0d50090ba OSJ-387: Always use try-with-resources with HttpClient requests ...
0d50090ba is described below

commit 0d50090ba28ef9b617bd8b1bd9e7d77d8c23ee83
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Thu Aug 31 19:27:02 2023 -0400

    OSJ-387: Always use try-with-resources with HttpClient requests ...
    
    Always use try-with-resources with HttpClient requests not involving
    HttpClientResponseHandler
---
 .../cas/proxy/impl/HttpClientProxyValidator.java   | 41 ++++++++--------------
 1 file changed, 15 insertions(+), 26 deletions(-)

diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java
index 7bf4434b7..0b8667059 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java
@@ -29,23 +29,11 @@ import javax.net.ssl.SSLPeerUnverifiedException;
 import javax.security.auth.login.CredentialException;
 import javax.security.auth.login.FailedLoginException;
 
-import net.shibboleth.idp.cas.config.AbstractProtocolConfiguration;
-import net.shibboleth.idp.cas.protocol.ProtocolContext;
-import net.shibboleth.idp.cas.proxy.ProxyValidator;
-import net.shibboleth.idp.cas.service.Service;
-import net.shibboleth.idp.cas.service.ServiceContext;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.resolver.CriteriaSet;
-
 import org.apache.hc.client5.http.ClientProtocolException;
 import org.apache.hc.client5.http.classic.HttpClient;
 import org.apache.hc.client5.http.classic.methods.HttpGet;
 import org.apache.hc.client5.http.protocol.HttpClientContext;
 import org.apache.hc.core5.http.ClassicHttpResponse;
-
 import org.opensaml.core.criterion.EntityIdCriterion;
 import org.opensaml.messaging.context.navigate.ChildContextLookup;
 import org.opensaml.profile.context.ProfileRequestContext;
@@ -61,6 +49,17 @@ import org.opensaml.security.trust.TrustEngine;
 import org.opensaml.security.x509.TrustedNamesCriterion;
 import org.slf4j.Logger;
 
+import net.shibboleth.idp.cas.config.AbstractProtocolConfiguration;
+import net.shibboleth.idp.cas.protocol.ProtocolContext;
+import net.shibboleth.idp.cas.proxy.ProxyValidator;
+import net.shibboleth.idp.cas.service.Service;
+import net.shibboleth.idp.cas.service.ServiceContext;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.resolver.CriteriaSet;
+
 /**
  * Authenticates a CAS proxy callback endpoint using an {@link HttpClient} instance to establish
  * the connection and a {@link TrustEngine} to verify the TLS certificate presented by the remote peer. The endpoint
@@ -154,12 +153,10 @@ public class HttpClientProxyValidator implements ProxyValidator {
         assert clientContext != null;
         HttpClientSecuritySupport.marshalSecurityParameters(clientContext, securityParameters, true);
         setCASTLSTrustEngineCriteria(clientContext, uri, service);
-        ClassicHttpResponse response = null;
-        try {
-            log.debug("Attempting to validate CAS proxy callback URI {}", uri);
-            final HttpGet request = new HttpGet(uri);
-            assert request != null;
-            response = httpClient.executeOpen(null, request, clientContext);
+        log.debug("Attempting to validate CAS proxy callback URI {}", uri);
+        final HttpGet request = new HttpGet(uri);
+        assert request != null;
+        try (final ClassicHttpResponse response = httpClient.executeOpen(null, request, clientContext)) {
             final String scheme = request.getScheme();
             assert scheme != null;
             HttpClientSecuritySupport.checkTLSCredentialEvaluated(clientContext, scheme);
@@ -175,14 +172,6 @@ public class HttpClientProxyValidator implements ProxyValidator {
             throw new GeneralSecurityException("SSL connection error", e);
         } catch (final IOException e) {
             throw new GeneralSecurityException("IO error", e);
-        } finally {
-            if (response != null) {
-                try {
-                    response.close();
-                } catch (final IOException e) {
-                    log.debug("Error closing HttpResponse", e);
-                }
-            }
         }
     }
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.