[java-oidc-common] branch main updated: Fix possible NPE in local credential resolver

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=578fdd203edfa4752c11e709213541b68fa58287

The following commit(s) were added to refs/heads/main by this push:
     new 578fdd2  Fix possible NPE in local credential resolver
578fdd2 is described below

commit 578fdd203edfa4752c11e709213541b68fa58287
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Feb 17 12:24:49 2023 +0000

    Fix possible NPE in local credential resolver
    
     - if the local credentials are null.
     - Also prevent the CollectionJOSEObjectCredentialResolver from setting
    null credentials
---
 .../impl/CollectionJOSEObjectCredentialResolver.java           | 10 ++++++----
 .../credential/impl/LocalJOSEObjectCredentialResolver.java     |  2 +-
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CollectionJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CollectionJOSEObjectCredentialResolver.java
index b45b01a..1767015 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CollectionJOSEObjectCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CollectionJOSEObjectCredentialResolver.java
@@ -20,6 +20,8 @@ package net.shibboleth.oidc.security.credential.impl;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
+import java.util.Objects;
+import java.util.stream.Collectors;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -27,6 +29,7 @@ import javax.annotation.Nullable;
 import org.opensaml.security.credential.Credential;
 
 import net.shibboleth.utilities.java.support.annotation.ParameterName;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
 import net.shibboleth.utilities.java.support.resolver.ResolverException;
@@ -48,7 +51,7 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
 public class CollectionJOSEObjectCredentialResolver extends BasicJOSEObjectCredentialResolver {
     
     /** List of credentials held by this resolver. */
-    private final List<Credential> collection;
+    @Nonnull @NonnullElements private final List<Credential> collection;
     
     /**
      * Constructor.
@@ -58,8 +61,7 @@ public class CollectionJOSEObjectCredentialResolver extends BasicJOSEObjectCrede
     public CollectionJOSEObjectCredentialResolver(
             @Nonnull @ParameterName(name="credentials") final List<Credential> credentials) {
         Constraint.isNotNull(credentials, "Input credentials list cannot be null");
-        
-        collection = new ArrayList<>(credentials);
+        collection = credentials.stream().filter(Objects::nonNull).collect(Collectors.toList());
     }
     
     /**
@@ -76,7 +78,7 @@ public class CollectionJOSEObjectCredentialResolver extends BasicJOSEObjectCrede
     }
 
     @Override
-    @Nonnull public Iterable<Credential> resolveFromSource(
+    @Nonnull @NonnullElements public Iterable<Credential> resolveFromSource(
             @Nullable final CriteriaSet criteria) throws ResolverException {
         return collection;
     }
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
index b1b4cd2..d96f20e 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
@@ -203,7 +203,7 @@ public class LocalJOSEObjectCredentialResolver extends BasicJOSEObjectCredential
         final ArrayList<Credential> localCreds = new ArrayList<>();
         
         for (final Credential cred : getLocalCredentialResolver().resolve(criteriaSet)) {
-            if (isLocalCredential(cred)) {
+            if (cred != null && isLocalCredential(cred)) {
                 localCreds.add(cred);
             }
         }        

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.