[java-oidc-common] branch main updated: JCOMOIDC-78 - Fix possible NPE in JWETokenDecrypter when jcaKeyAlg is not supported by the registry

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=6e8f3cd0ff72bcc15cf63d33def7ddab627bf0a3

The following commit(s) were added to refs/heads/main by this push:
     new 6e8f3cd  JCOMOIDC-78 - Fix possible NPE in JWETokenDecrypter when jcaKeyAlg is not supported by the registry
6e8f3cd is described below

commit 6e8f3cd0ff72bcc15cf63d33def7ddab627bf0a3
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Jul 20 14:20:06 2023 +0100

    JCOMOIDC-78 - Fix possible NPE in JWETokenDecrypter when jcaKeyAlg is
    not supported by the registry
    
     - Added check for null JCA Key Algorithm
    
    https://shibboleth.atlassian.net/browse/JCOMOIDC-78
---
 .../net/shibboleth/oidc/security/impl/JWETokenDecrypter.java     | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWETokenDecrypter.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWETokenDecrypter.java
index 0362e3e..2911d31 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWETokenDecrypter.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWETokenDecrypter.java
@@ -610,13 +610,18 @@ public class JWETokenDecrypter {
      */
     @Nonnull private EncryptionMethod validateContentEncryptionAlgorithm(
             @Nonnull final EncryptedJWT encryptedObject, @Nonnull final JWKCredential cred) throws DecryptionException {
+    	
+    	if (cred.getSecretKey() == null) {
+            throw new DecryptionException("Credential does not contain a content encryption secret key");
+        }
         
         final EncryptionMethod enc = validateContentEncryptionAlgorithm(encryptedObject);
         
         final String jcaKeyAlgorithm = AlgorithmSupport.getKeyAlgorithm(StringSupport.trimOrNull(enc.getName()));
         
-        if (cred.getSecretKey() == null) {
-            throw new DecryptionException("Credential does not contain a content encryption secret key");
+        if (jcaKeyAlgorithm == null) {
+        	 throw new DecryptionException("JOSE Header 'enc' algorithm is not supported by the "
+        	 		+ "algorithm registry");
         }
             
         if (!jcaKeyAlgorithm.equals(cred.getSecretKey().getAlgorithm())) {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.