[java-opensaml] branch main updated: IDP-2069 - Null Handling Task
Scott Cantor
cantor.2 at osu.edu
Wed Mar 8 21:41:43 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=f3b42a4dc1d21d3fa6b302dae9f73487e5bb45e7
The following commit(s) were added to refs/heads/main by this push:
new f3b42a4dc IDP-2069 - Null Handling Task
f3b42a4dc is described below
commit f3b42a4dc1d21d3fa6b302dae9f73487e5bb45e7
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Mar 8 16:41:40 2023 -0500
IDP-2069 - Null Handling Task
https://shibboleth.atlassian.net/browse/IDP-2069
Clean up opensaml-spring.
---
.../org/opensaml/security/x509/X509Support.java | 39 ++++++++++---------
.../AbstractBasicCredentialFactoryBean.java | 14 ++++---
.../credential/AbstractCredentialFactoryBean.java | 13 +++----
.../AbstractX509CredentialFactoryBean.java | 9 +++--
.../BasicInlineCredentialFactoryBean.java | 6 ++-
.../BasicResourceCredentialFactoryBean.java | 29 +++++++++-----
.../credential/BasicX509CredentialFactoryBean.java | 45 +++++++++++++---------
.../X509InlineCredentialFactoryBean.java | 23 ++++++++---
.../spring/tls/TLSSocketFactoryFactoryBean.java | 8 ++--
...AbstractBasicPKIXValidationInfoFactoryBean.java | 13 ++++---
.../ChainingSignatureTrustEngineFactoryBean.java | 25 +++++++-----
.../trust/ChainingTrustEngineFactoryBean.java | 20 +++++++---
.../trust/PKIXInlineValidationInfoFactoryBean.java | 16 ++++++--
.../PKIXResourceValidationInfoFactoryBean.java | 15 ++++++--
.../spring/trust/StaticExplicitKeyFactoryBean.java | 23 +++++------
.../spring/trust/StaticPKIXFactoryBean.java | 18 ++++++---
.../BasicX509CredentialFactoryBeanTest.java | 8 +++-
.../spring/trust/AbstractSecurityTest.java | 7 ++--
.../org/opensaml/spring/trust/MockTrustEngine.java | 6 ++-
.../trust/StaticExplicitKeyFactoryBeanTest.java | 11 +++---
.../spring/trust/StaticPKIXFactoryBeanTest.java | 15 +++++---
21 files changed, 227 insertions(+), 136 deletions(-)
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java
index 141596b66..800224c4c 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java
@@ -44,6 +44,7 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import javax.security.auth.x500.X500Principal;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.codec.Base64Support;
import net.shibboleth.shared.codec.DecodingException;
import net.shibboleth.shared.logic.Constraint;
@@ -77,37 +78,37 @@ import com.google.common.net.InetAddresses;
public class X509Support {
/** Common Name (CN) OID. */
- public static final String CN_OID = "2.5.4.3";
+ @Nonnull @NotEmpty public static final String CN_OID = "2.5.4.3";
/** Subject Key Identifier (SKI) OID. */
- public static final String SKI_OID = "2.5.29.14";
+ @Nonnull @NotEmpty public static final String SKI_OID = "2.5.29.14";
/** RFC 2459 Other Subject Alt Name type. */
- public static final Integer OTHER_ALT_NAME = 0;
+ @Nonnull public static final Integer OTHER_ALT_NAME = 0;
/** RFC 2459 RFC 822 (email address) Subject Alt Name type. */
- public static final Integer RFC822_ALT_NAME = 1;
+ @Nonnull public static final Integer RFC822_ALT_NAME = 1;
/** RFC 2459 DNS Subject Alt Name type. */
- public static final Integer DNS_ALT_NAME = 2;
+ @Nonnull public static final Integer DNS_ALT_NAME = 2;
/** RFC 2459 X.400 Address Subject Alt Name type. */
- public static final Integer X400ADDRESS_ALT_NAME = 3;
+ @Nonnull public static final Integer X400ADDRESS_ALT_NAME = 3;
/** RFC 2459 Directory Name Subject Alt Name type. */
- public static final Integer DIRECTORY_ALT_NAME = 4;
+ @Nonnull public static final Integer DIRECTORY_ALT_NAME = 4;
/** RFC 2459 EDI Party Name Subject Alt Name type. */
- public static final Integer EDI_PARTY_ALT_NAME = 5;
+ @Nonnull public static final Integer EDI_PARTY_ALT_NAME = 5;
/** RFC 2459 URI Subject Alt Name type. */
- public static final Integer URI_ALT_NAME = 6;
+ @Nonnull public static final Integer URI_ALT_NAME = 6;
/** RFC 2459 IP Address Subject Alt Name type. */
- public static final Integer IP_ADDRESS_ALT_NAME = 7;
+ @Nonnull public static final Integer IP_ADDRESS_ALT_NAME = 7;
/** RFC 2459 Registered ID Subject Alt Name type. */
- public static final Integer REGISTERED_ID_ALT_NAME = 8;
+ @Nonnull public static final Integer REGISTERED_ID_ALT_NAME = 8;
/** Logger. */
@Nonnull private static final Logger LOG = LoggerFactory.getLogger(X509Support.class);
@@ -324,7 +325,7 @@ public class X509Support {
*
* @since 1.2
*/
- @Nullable public static Collection<X509Certificate> decodeCertificates(@Nonnull final InputStream certs)
+ @Nonnull public static Collection<X509Certificate> decodeCertificates(@Nonnull final InputStream certs)
throws CertificateException {
Constraint.isNotNull(certs, "Input Stream cannot be null");
@@ -366,7 +367,7 @@ public class X509Support {
*
* @since 1.2
*/
- @Nullable public static X509Certificate decodeCertificate(@Nonnull final File cert) throws CertificateException {
+ @Nonnull public static X509Certificate decodeCertificate(@Nonnull final File cert) throws CertificateException {
Constraint.isNotNull(cert, "Input file cannot be null");
if (!cert.exists()) {
throw new CertificateException("Certificate file " + cert.getAbsolutePath() + " does not exist");
@@ -390,7 +391,7 @@ public class X509Support {
*
* @throws CertificateException thrown if the certificate cannot be decoded
*/
- @Nullable public static X509Certificate decodeCertificate(@Nonnull final byte[] cert) throws CertificateException {
+ @Nonnull public static X509Certificate decodeCertificate(@Nonnull final byte[] cert) throws CertificateException {
try {
return CertUtil.decodeCertificate(cert);
} catch (final IllegalArgumentException | EncodingException e) {
@@ -405,7 +406,7 @@ public class X509Support {
* @return a native Java X509 certificate
* @throws CertificateException thrown if there is an error constructing certificate
*/
- @Nullable public static X509Certificate decodeCertificate(@Nonnull final String base64Cert)
+ @Nonnull public static X509Certificate decodeCertificate(@Nonnull final String base64Cert)
throws CertificateException {
try {
return decodeCertificate(Base64Support.decode(base64Cert));
@@ -426,7 +427,7 @@ public class X509Support {
*
* @since 1.2
*/
- @Nullable public static Collection<X509CRL> decodeCRLs(@Nonnull final File crls) throws CRLException{
+ @Nonnull public static Collection<X509CRL> decodeCRLs(@Nonnull final File crls) throws CRLException{
Constraint.isNotNull(crls, "Input file cannot be null");
if (!crls.exists()) {
throw new CRLException("CRL file " + crls.getAbsolutePath() + " does not exist");
@@ -453,7 +454,7 @@ public class X509Support {
*
* @since 1.2
*/
- @Nullable public static Collection<X509CRL> decodeCRLs(@Nonnull final InputStream crls) throws CRLException{
+ @Nonnull public static Collection<X509CRL> decodeCRLs(@Nonnull final InputStream crls) throws CRLException{
Constraint.isNotNull(crls, "Input stream cannot be null");
try {
@@ -474,7 +475,7 @@ public class X509Support {
*
* @throws CRLException thrown if the CRLs can not be decoded
*/
- @Nullable public static Collection<X509CRL> decodeCRLs(@Nonnull final byte[] crls) throws CRLException {
+ @Nonnull public static Collection<X509CRL> decodeCRLs(@Nonnull final byte[] crls) throws CRLException {
try {
final CertificateFactory cf = CertificateFactory.getInstance("X.509");
return (Collection<X509CRL>) cf.generateCRLs(new ByteArrayInputStream(crls));
@@ -491,7 +492,7 @@ public class X509Support {
* @throws CertificateException thrown if there is an error constructing certificate
* @throws CRLException thrown if there is an error constructing CRL
*/
- @Nullable public static X509CRL decodeCRL(@Nonnull final String base64CRL)
+ @Nonnull public static X509CRL decodeCRL(@Nonnull final String base64CRL)
throws CertificateException, CRLException {
try {
final CertificateFactory cf = CertificateFactory.getInstance("X.509");
diff --git a/opensaml-spring/src/main/java/org/opensaml/spring/credential/AbstractBasicCredentialFactoryBean.java b/opensaml-spring/src/main/java/org/opensaml/spring/credential/AbstractBasicCredentialFactoryBean.java
index 670fc0624..d89ed0124 100644
--- a/opensaml-spring/src/main/java/org/opensaml/spring/credential/AbstractBasicCredentialFactoryBean.java
+++ b/opensaml-spring/src/main/java/org/opensaml/spring/credential/AbstractBasicCredentialFactoryBean.java
@@ -26,6 +26,7 @@ import javax.annotation.Nullable;
import javax.crypto.SecretKey;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
import org.apache.commons.codec.binary.Base64;
@@ -34,7 +35,7 @@ import org.opensaml.security.credential.BasicCredential;
import org.opensaml.security.credential.UsageType;
import org.opensaml.security.crypto.KeySupport;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
import org.springframework.beans.factory.BeanCreationException;
/**
@@ -53,7 +54,7 @@ public abstract class AbstractBasicCredentialFactoryBean extends AbstractCredent
}
/** Log. */
- private final Logger log = LoggerFactory.getLogger(AbstractBasicCredentialFactoryBean.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AbstractBasicCredentialFactoryBean.class);
/** The SecretKey algorithm. */
@Nullable private String secretKeyAlgorithm;
@@ -67,7 +68,7 @@ public abstract class AbstractBasicCredentialFactoryBean extends AbstractCredent
* @param data the Secret key data
* @return the decoded SecretKey byte array
*/
- protected byte[] decodeSecretKey(final String data) {
+ @Nonnull protected byte[] decodeSecretKey(final String data) {
Constraint.isNotNull(data, "SecretKey data was null");
switch (getSecretKeyEncoding()) {
case binary:
@@ -76,7 +77,7 @@ public abstract class AbstractBasicCredentialFactoryBean extends AbstractCredent
return data.getBytes("UTF-8");
} catch (final UnsupportedEncodingException e) {
// Can't actually happen, UTF-8 always supported.
- return null;
+ throw new UnsupportedOperationException(e);
}
case hex:
return Hex.decode(data);
@@ -94,7 +95,7 @@ public abstract class AbstractBasicCredentialFactoryBean extends AbstractCredent
* @param data the Secret key data
* @return the decoded SecretKey byte array
*/
- protected byte[] decodeSecretKey(final byte[] data) {
+ @Nonnull protected byte[] decodeSecretKey(final byte[] data) {
Constraint.isNotNull(data, "SecretKey data was null");
switch (getSecretKeyEncoding()) {
case binary:
@@ -110,7 +111,8 @@ public abstract class AbstractBasicCredentialFactoryBean extends AbstractCredent
}
/** {@inheritDoc} */
- @Override protected BasicCredential doCreateInstance() throws Exception {
+ @Override
+ @Nonnull protected BasicCredential doCreateInstance() throws Exception {
final PrivateKey privateKey = getPrivateKey();
final PublicKey publicKey = getPublicKey();
diff --git a/opensaml-spring/src/main/java/org/opensaml/spring/credential/AbstractCredentialFactoryBean.java b/opensaml-spring/src/main/java/org/opensaml/spring/credential/AbstractCredentialFactoryBean.java
index 869c92dfb..d0312bcf5 100644
--- a/opensaml-spring/src/main/java/org/opensaml/spring/credential/AbstractCredentialFactoryBean.java
+++ b/opensaml-spring/src/main/java/org/opensaml/spring/credential/AbstractCredentialFactoryBean.java
@@ -19,7 +19,6 @@ package org.opensaml.spring.credential;
import java.util.List;
-import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
@@ -34,19 +33,19 @@ import net.shibboleth.shared.spring.factory.AbstractComponentAwareFactoryBean;
public abstract class AbstractCredentialFactoryBean<T extends Credential> extends AbstractComponentAwareFactoryBean<T> {
/** Usage type of the credential. */
- private String usageType;
+ @Nullable private String usageType;
/** Names for the key represented by the credential. */
- private List<String> keyNames;
+ @Nullable private List<String> keyNames;
/** Identifier for the owner of the credential. */
- private String entityID;
+ @Nullable private String entityID;
/** The privateKey Password (if any). */
@Nullable private char[] privateKeyPassword;
/** For logging: The description of the source of the configuration.*/
- @Nonnull private String configDescription;
+ @Nullable private String configDescription;
/**
* Gets the names for the key represented by the credential.
@@ -131,14 +130,14 @@ public abstract class AbstractCredentialFactoryBean<T extends Credential> extend
/** For logging, get the description of the resource that defined this bean.
* @return Returns the description.
*/
- public String getConfigDescription() {
+ @Nullable public String getConfigDescription() {
return configDescription;
}
/** For logging, set the description of the resource that defined this bean.
* @param desc what to set.
*/
- public void setConfigDescription(@Nonnull final String desc) {
+ public void setConfigDescription(@Nullable final String desc) {
configDescription = desc;
}
}
diff --git a/opensaml-spring/src/main/java/org/opensaml/spring/credential/AbstractX509CredentialFactoryBean.java b/opensaml-spring/src/main/java/org/opensaml/spring/credential/AbstractX509CredentialFactoryBean.java
index ecc9a065c..2c56dc1d0 100644
--- a/opensaml-spring/src/main/java/org/opensaml/spring/credential/AbstractX509CredentialFactoryBean.java
+++ b/opensaml-spring/src/main/java/org/opensaml/spring/credential/AbstractX509CredentialFactoryBean.java
@@ -29,10 +29,10 @@ import org.opensaml.security.credential.UsageType;
import org.opensaml.security.crypto.KeySupport;
import org.opensaml.security.x509.BasicX509Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.BeanCreationException;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A factory bean to collect information to do with an X509 backed {@link BasicX509Credential}.
@@ -40,11 +40,12 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
public abstract class AbstractX509CredentialFactoryBean extends AbstractCredentialFactoryBean<BasicX509Credential> {
/** Log. */
- private final Logger log = LoggerFactory.getLogger(AbstractX509CredentialFactoryBean.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AbstractX509CredentialFactoryBean.class);
/** {@inheritDoc} */
// Checkstyle: CyclomaticComplexity OFF
- @Override protected BasicX509Credential doCreateInstance() throws Exception {
+ @Override
+ @Nonnull protected BasicX509Credential doCreateInstance() throws Exception {
final List<X509Certificate> certificates = getCertificates();
if (null == certificates || certificates.isEmpty()) {
@@ -56,6 +57,8 @@ public abstract class AbstractX509CredentialFactoryBean extends AbstractCredenti
if (null == entityCertificate) {
entityCertificate = certificates.get(0);
}
+
+ assert entityCertificate != null;
final PrivateKey privateKey = getPrivateKey();
diff --git a/opensaml-spring/src/main/java/org/opensaml/spring/credential/BasicInlineCredentialFactoryBean.java b/opensaml-spring/src/main/java/org/opensaml/spring/credential/BasicInlineCredentialFactoryBean.java
index bac2aebc0..dc7ebcab4 100644
--- a/opensaml-spring/src/main/java/org/opensaml/spring/credential/BasicInlineCredentialFactoryBean.java
+++ b/opensaml-spring/src/main/java/org/opensaml/spring/credential/BasicInlineCredentialFactoryBean.java
@@ -118,7 +118,11 @@ public class BasicInlineCredentialFactoryBean extends AbstractBasicCredentialFac
return null;
}
try {
- return KeySupport.decodeSecretKey(decodeSecretKey(getSecretKeyInfo()), getSecretKeyAlgorithm());
+ final String alg = getSecretKeyAlgorithm();
+ if (alg == null) {
+ throw new KeyException("Key algorithm was null");
+ }
+ return KeySupport.decodeSecretKey(decodeSecretKey(getSecretKeyInfo()), alg);
} catch (final KeyException e) {
throw new BeanCreationException("Could not decode secret key", e);
}
diff --git a/opensaml-spring/src/main/java/org/opensaml/spring/credential/BasicResourceCredentialFactoryBean.java b/opensaml-spring/src/main/java/org/opensaml/spring/credential/BasicResourceCredentialFactoryBean.java
index f70bcf263..0543a6a6b 100644
--- a/opensaml-spring/src/main/java/org/opensaml/spring/credential/BasicResourceCredentialFactoryBean.java
+++ b/opensaml-spring/src/main/java/org/opensaml/spring/credential/BasicResourceCredentialFactoryBean.java
@@ -23,25 +23,28 @@ import java.security.KeyException;
import java.security.PrivateKey;
import java.security.PublicKey;
+import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import javax.crypto.SecretKey;
import org.cryptacular.util.KeyPairUtil;
import org.opensaml.security.crypto.KeySupport;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
import org.springframework.beans.factory.BeanCreationException;
import org.springframework.core.io.Resource;
import com.google.common.io.ByteStreams;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* Spring bean factory for producing a {@link org.opensaml.security.credential.BasicCredential} from {@link Resource}s.
*/
public class BasicResourceCredentialFactoryBean extends AbstractBasicCredentialFactoryBean {
/** log. */
- private final Logger log = LoggerFactory.getLogger(BasicResourceCredentialFactoryBean.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(BasicResourceCredentialFactoryBean.class);
/** Configured public key Info. */
@Nullable private Resource publicKeyInfo;
@@ -108,10 +111,11 @@ public class BasicResourceCredentialFactoryBean extends AbstractBasicCredentialF
/** {@inheritDoc} */
@Override @Nullable protected PublicKey getPublicKey() {
- if (null == getPublicKeyInfo()) {
+ final Resource pkinfo = getPublicKeyInfo();
+ if (null == pkinfo) {
return null;
}
- try (InputStream is = getPublicKeyInfo().getInputStream()) {
+ try (final InputStream is = pkinfo.getInputStream()) {
return KeyPairUtil.readPublicKey(is);
} catch (final IOException e) {
log.error("{}: Could not decode public key: {}", getConfigDescription(), e.getMessage());
@@ -121,10 +125,11 @@ public class BasicResourceCredentialFactoryBean extends AbstractBasicCredentialF
/** {@inheritDoc} */
@Override @Nullable protected PrivateKey getPrivateKey() {
- if (null == getPrivateKeyInfo()) {
+ final Resource pkinfo = getPrivateKeyInfo();
+ if (null == pkinfo) {
return null;
}
- try (InputStream is = getPrivateKeyInfo().getInputStream()) {
+ try (final InputStream is = pkinfo.getInputStream()) {
return KeySupport.decodePrivateKey(is, getPrivateKeyPassword());
} catch (final KeyException | IOException e) {
log.error("{}: Could not decode private key: {}", getConfigDescription(), e.getMessage());
@@ -134,11 +139,17 @@ public class BasicResourceCredentialFactoryBean extends AbstractBasicCredentialF
/** {@inheritDoc} */
@Override @Nullable protected SecretKey getSecretKey() {
- if (null == getSecretKeyInfo()) {
+ final Resource skinfo = getSecretKeyInfo();
+ if (null == skinfo) {
return null;
}
- try (InputStream is = getSecretKeyInfo().getInputStream()) {
- return KeySupport.decodeSecretKey(decodeSecretKey(ByteStreams.toByteArray(is)), getSecretKeyAlgorithm());
+
+ try (final InputStream is = skinfo.getInputStream()) {
+ final String alg = getSecretKeyAlgorithm();
+ if (alg == null) {
+ throw new KeyException("Key algorithm was null");
+ }
+ return KeySupport.decodeSecretKey(decodeSecretKey(ByteStreams.toByteArray(is)), alg);
} catch (final KeyException | IOException e) {
log.error("{}: Could not decode secret key: {}", getConfigDescription(), e.getMessage());
throw new BeanCreationException("Could not decode secret key", e);
diff --git a/opensaml-spring/src/main/java/org/opensaml/spring/credential/BasicX509CredentialFactoryBean.java b/opensaml-spring/src/main/java/org/opensaml/spring/credential/BasicX509CredentialFactoryBean.java
index fe58617b2..289bf34d6 100644
--- a/opensaml-spring/src/main/java/org/opensaml/spring/credential/BasicX509CredentialFactoryBean.java
+++ b/opensaml-spring/src/main/java/org/opensaml/spring/credential/BasicX509CredentialFactoryBean.java
@@ -26,19 +26,20 @@ import java.security.cert.CertificateException;
import java.security.cert.X509CRL;
import java.security.cert.X509Certificate;
import java.util.Collection;
-import java.util.Collections;
import java.util.List;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.collection.LazyList;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.security.crypto.KeySupport;
import org.opensaml.security.x509.X509Support;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
import org.springframework.beans.FatalBeanException;
import org.springframework.core.io.Resource;
@@ -53,19 +54,19 @@ import org.springframework.core.io.Resource;
public class BasicX509CredentialFactoryBean extends AbstractX509CredentialFactoryBean {
/** log. */
- private final Logger log = LoggerFactory.getLogger(BasicX509CredentialFactoryBean.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(BasicX509CredentialFactoryBean.class);
/** The specification of where the entity Resource is to be found. */
- private Resource entityResource;
+ @Nullable private Resource entityResource;
/** Where the certificates are to be found. */
- private List<Resource> certificateResources;
+ @Nullable private List<Resource> certificateResources;
/** Where the private key is to be found. */
- private Resource privateKeyResource;
+ @Nullable private Resource privateKeyResource;
/** Where the crls are to be found. */
- private List<Resource> crlResources;
+ @Nullable private List<Resource> crlResources;
/**
* Set the Resource with the entity certificate.
@@ -121,7 +122,11 @@ public class BasicX509CredentialFactoryBean extends AbstractX509CredentialFactor
* @param password password for the private key, may be null if the key is not encrypted
*/
public void setPrivateKeyPassword(@Nullable final String password) {
- setPrivateKeyPassword(password.toCharArray());
+ if (password != null) {
+ setPrivateKeyPassword(password.toCharArray());
+ } else {
+ setPrivateKeyPassword((char[]) null);
+ }
}
/**
@@ -130,7 +135,7 @@ public class BasicX509CredentialFactoryBean extends AbstractX509CredentialFactor
* @param res certificate resource
*/
public void setCertificateResource(@Nonnull final Resource res) {
- setCertificates(Collections.singletonList(res));
+ setCertificates(CollectionSupport.singletonList(res));
}
/**
@@ -150,11 +155,12 @@ public class BasicX509CredentialFactoryBean extends AbstractX509CredentialFactor
/** {@inheritDoc}. */
@Override @Nullable protected X509Certificate getEntityCertificate() {
- if (null == entityResource) {
+ final Resource localEntityResource = entityResource;
+ if (null == localEntityResource) {
return null;
}
try {
- final Collection<X509Certificate> certs = X509Support.decodeCertificates(entityResource.getInputStream());
+ final Collection<X509Certificate> certs = X509Support.decodeCertificates(localEntityResource.getInputStream());
if (certs.size() > 1) {
log.error("{}: Configuration element indicated an entityCertificate,"
+ " but multiple certificates were decoded", getConfigDescription());
@@ -164,9 +170,9 @@ public class BasicX509CredentialFactoryBean extends AbstractX509CredentialFactor
return certs.iterator().next();
} catch (final CertificateException | IOException e) {
log.error("{}: Could not decode provided Entity Certificate at {}: {}", getConfigDescription(),
- entityResource.getDescription(), e.getMessage());
+ localEntityResource.getDescription(), e.getMessage());
throw new FatalBeanException("Could not decode provided Entity Certificate file "
- + entityResource.getDescription(), e);
+ + localEntityResource.getDescription(), e);
}
}
@@ -174,10 +180,11 @@ public class BasicX509CredentialFactoryBean extends AbstractX509CredentialFactor
@Override @Nonnull protected List<X509Certificate> getCertificates() {
if (certificateResources == null) {
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
final List<X509Certificate> certificates = new LazyList<>();
+ assert certificateResources != null;
for (final Resource r : certificateResources) {
try(InputStream is = r.getInputStream()) {
certificates.addAll(X509Support.decodeCertificates(is));
@@ -192,15 +199,16 @@ public class BasicX509CredentialFactoryBean extends AbstractX509CredentialFactor
/** {@inheritDoc} */
@Override @Nullable protected PrivateKey getPrivateKey() {
- if (null == privateKeyResource) {
+ final Resource localResource = privateKeyResource;
+ if (null == localResource) {
return null;
}
- try (InputStream is = privateKeyResource.getInputStream()) {
+ try (InputStream is = localResource.getInputStream()) {
return KeySupport.decodePrivateKey(is, getPrivateKeyPassword());
} catch (final KeyException | IOException e) {
log.error("{}: Could not decode KeyFile at {}: {}", getConfigDescription(),
- privateKeyResource.getDescription(), e.getMessage());
- throw new FatalBeanException("Could not decode provided KeyFile " + privateKeyResource.getDescription(), e);
+ localResource.getDescription(), e.getMessage());
+ throw new FatalBeanException("Could not decode provided KeyFile " + localResource.getDescription(), e);
}
}
@@ -210,6 +218,7 @@ public class BasicX509CredentialFactoryBean extends AbstractX509CredentialFactor
return null;
}
final List<X509CRL> crls = new LazyList<>();
+ assert crlResources != null;
for (final Resource crl : crlResources) {
try (InputStream is = crl.getInputStream()) {
crls.addAll(X509Support.decodeCRLs(is));
diff --git a/opensaml-spring/src/main/java/org/opensaml/spring/credential/X509InlineCredentialFactoryBean.java b/opensaml-spring/src/main/java/org/opensaml/spring/credential/X509InlineCredentialFactoryBean.java
index 6a1f00af6..7f9152a8a 100644
--- a/opensaml-spring/src/main/java/org/opensaml/spring/credential/X509InlineCredentialFactoryBean.java
+++ b/opensaml-spring/src/main/java/org/opensaml/spring/credential/X509InlineCredentialFactoryBean.java
@@ -28,12 +28,14 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.collection.LazyList;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.cryptacular.util.KeyPairUtil;
import org.opensaml.security.x509.X509Support;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
import org.springframework.beans.FatalBeanException;
/**
@@ -42,19 +44,19 @@ import org.springframework.beans.FatalBeanException;
public class X509InlineCredentialFactoryBean extends AbstractX509CredentialFactoryBean {
/** log. */
- private final Logger log = LoggerFactory.getLogger(X509InlineCredentialFactoryBean.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(X509InlineCredentialFactoryBean.class);
/** The entity certificate. */
- private String entityCertificate;
+ @Nullable private String entityCertificate;
/** The certificates. */
- private List<String> certificates;
+ @Nullable private List<String> certificates;
/** The private key. */
- private byte[] privateKey;
+ @Nullable private byte[] privateKey;
/** The crls. */
- private List<String> crls;
+ @Nullable private List<String> crls;
/**
* Set the file with the entity certificate.
@@ -99,6 +101,7 @@ public class X509InlineCredentialFactoryBean extends AbstractX509CredentialFacto
return null;
}
try {
+ assert entityCertificate != null;
return X509Support.decodeCertificate(entityCertificate);
} catch (final CertificateException e) {
log.error("{}: Could not decode provided Entity Certificate: {}", getConfigDescription(), e.getMessage());
@@ -108,7 +111,13 @@ public class X509InlineCredentialFactoryBean extends AbstractX509CredentialFacto
/** {@inheritDoc} */
@Override @Nonnull protected List<X509Certificate> getCertificates() {
+
+ if (certificates == null) {
+ return CollectionSupport.emptyList();
+ }
+
final List<X509Certificate> certs = new LazyList<>();
+ assert certificates != null;
for (final String cert : certificates) {
try {
certs.add(X509Support.decodeCertificate(cert.trim()));
@@ -134,8 +143,10 @@ public class X509InlineCredentialFactoryBean extends AbstractX509CredentialFacto
return null;
}
final List<X509CRL> result = new LazyList<>();
+ assert crls != null;
for (final String crl : crls) {
try {
+ assert crl != null;
result.add(X509Support.decodeCRL(crl));
} catch (final CRLException | CertificateException e) {
log.error("{}: Could not decode provided CRL: {}", getConfigDescription(), e.getMessage());
diff --git a/opensaml-spring/src/main/java/org/opensaml/spring/tls/TLSSocketFactoryFactoryBean.java b/opensaml-spring/src/main/java/org/opensaml/spring/tls/TLSSocketFactoryFactoryBean.java
index dd63a9462..c1bb51c6d 100644
--- a/opensaml-spring/src/main/java/org/opensaml/spring/tls/TLSSocketFactoryFactoryBean.java
+++ b/opensaml-spring/src/main/java/org/opensaml/spring/tls/TLSSocketFactoryFactoryBean.java
@@ -17,6 +17,7 @@
package org.opensaml.spring.tls;
+import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.apache.hc.client5.http.socket.LayeredConnectionSocketFactory;
@@ -35,10 +36,10 @@ import net.shibboleth.shared.httpclient.HttpClientSupport;
public class TLSSocketFactoryFactoryBean extends AbstractFactoryBean<LayeredConnectionSocketFactory> {
/** The optional trust engine used in evaluating server TLS credentials. */
- private TrustEngine<?> tlsTrustEngine;
+ @Nullable private TrustEngine<?> tlsTrustEngine;
/** The optional HttpClient security parameters instance that will be used with the HttpClient instance. */
- private HttpClientSecurityParameters httpClientSecurityParameters;
+ @Nullable private HttpClientSecurityParameters httpClientSecurityParameters;
/** Whether the responder's SSL/TLS certificate should be ignored. */
private boolean connectionDisregardTLSCertificate;
@@ -79,7 +80,8 @@ public class TLSSocketFactoryFactoryBean extends AbstractFactoryBean<LayeredConn
}
/** {@inheritDoc} */
- @Override protected LayeredConnectionSocketFactory createInstance() throws Exception {
+ @Override
+ @Nonnull protected LayeredConnectionSocketFactory createInstance() throws Exception {
final boolean haveTrustEngine = tlsTrustEngine != null
|| (httpClientSecurityParameters != null && httpClientSecurityParameters.getTLSTrustEngine() != null);
final boolean haveClientTLSCred =
diff --git a/opensaml-spring/src/main/java/org/opensaml/spring/trust/AbstractBasicPKIXValidationInfoFactoryBean.java b/opensaml-spring/src/main/java/org/opensaml/spring/trust/AbstractBasicPKIXValidationInfoFactoryBean.java
index b383b9e69..af078968d 100644
--- a/opensaml-spring/src/main/java/org/opensaml/spring/trust/AbstractBasicPKIXValidationInfoFactoryBean.java
+++ b/opensaml-spring/src/main/java/org/opensaml/spring/trust/AbstractBasicPKIXValidationInfoFactoryBean.java
@@ -38,14 +38,14 @@ public abstract class AbstractBasicPKIXValidationInfoFactoryBean extends
@Nullable private Integer verifyDepth;
/** The description of the file with the configuration us. */
- @Nonnull private String configDescription;
+ @Nullable private String configDescription;
/**
* Get the verify Depth.
*
* @return Returns the depth.
*/
- public int getVerifyDepth() {
+ @Nullable public Integer getVerifyDepth() {
return verifyDepth;
}
@@ -54,7 +54,7 @@ public abstract class AbstractBasicPKIXValidationInfoFactoryBean extends
*
* @param depth The value to set.
*/
- public void setVerifyDepth(final int depth) {
+ public void setVerifyDepth(@Nullable final Integer depth) {
verifyDepth = depth;
}
@@ -63,7 +63,7 @@ public abstract class AbstractBasicPKIXValidationInfoFactoryBean extends
*
* @return Returns the description.
*/
- public String getConfigDescription() {
+ @Nullable public String getConfigDescription() {
return configDescription;
}
@@ -72,7 +72,7 @@ public abstract class AbstractBasicPKIXValidationInfoFactoryBean extends
*
* @param desc what to set.
*/
- public void setConfigDescription(@Nonnull final String desc) {
+ public void setConfigDescription(@Nullable final String desc) {
configDescription = desc;
}
@@ -82,7 +82,8 @@ public abstract class AbstractBasicPKIXValidationInfoFactoryBean extends
}
/** {@inheritDoc} */
- @Override protected BasicPKIXValidationInformation doCreateInstance() throws Exception {
+ @Override
+ @Nonnull protected BasicPKIXValidationInformation doCreateInstance() throws Exception {
return new BasicPKIXValidationInformation(getCertificates(), getCRLs(), verifyDepth);
}
diff --git a/opensaml-spring/src/main/java/org/opensaml/spring/trust/ChainingSignatureTrustEngineFactoryBean.java b/opensaml-spring/src/main/java/org/opensaml/spring/trust/ChainingSignatureTrustEngineFactoryBean.java
index 614af8114..b0d6decbb 100644
--- a/opensaml-spring/src/main/java/org/opensaml/spring/trust/ChainingSignatureTrustEngineFactoryBean.java
+++ b/opensaml-spring/src/main/java/org/opensaml/spring/trust/ChainingSignatureTrustEngineFactoryBean.java
@@ -21,8 +21,9 @@ import java.util.ArrayList;
import java.util.List;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
-import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.spring.factory.AbstractComponentAwareFactoryBean;
import org.opensaml.xmlsec.signature.support.SignatureTrustEngine;
@@ -37,33 +38,39 @@ public class ChainingSignatureTrustEngineFactoryBean extends
AbstractComponentAwareFactoryBean<ChainingSignatureTrustEngine> {
/** The unfiltered list of putative trust engines. */
- private final List<Object> engines;
+ @Nullable private final List<Object> engines;
/**
* Constructor.
*
* @param list the putative trust engines.
*/
- public ChainingSignatureTrustEngineFactoryBean(@Nonnull final List<Object> list) {
- engines = Constraint.isNotNull(list, "Engine list must be non null");
+ public ChainingSignatureTrustEngineFactoryBean(@Nullable final List<Object> list) {
+ engines = list;
}
/** {@inheritDoc} */
- @Override public Class<?> getObjectType() {
+ @Override
+ @Nonnull public Class<?> getObjectType() {
return ChainingSignatureTrustEngine.class;
}
/** {@inheritDoc} */
- @Override protected ChainingSignatureTrustEngine doCreateInstance() throws Exception {
- final List<SignatureTrustEngine> list = new ArrayList<>(engines.size());
+ @Override
+ @Nonnull protected ChainingSignatureTrustEngine doCreateInstance() throws Exception {
+ if (engines == null) {
+ return new ChainingSignatureTrustEngine(CollectionSupport.emptyList());
+ }
+ assert engines != null;
+ final List<SignatureTrustEngine> list = new ArrayList<>(engines.size());
+ assert engines != null;
for (final Object engine : engines) {
if (engine instanceof SignatureTrustEngine) {
list.add((SignatureTrustEngine) engine);
-
}
}
return new ChainingSignatureTrustEngine(list);
}
-}
+}
\ No newline at end of file
diff --git a/opensaml-spring/src/main/java/org/opensaml/spring/trust/ChainingTrustEngineFactoryBean.java b/opensaml-spring/src/main/java/org/opensaml/spring/trust/ChainingTrustEngineFactoryBean.java
index a3b3ee71a..bfa468616 100644
--- a/opensaml-spring/src/main/java/org/opensaml/spring/trust/ChainingTrustEngineFactoryBean.java
+++ b/opensaml-spring/src/main/java/org/opensaml/spring/trust/ChainingTrustEngineFactoryBean.java
@@ -21,8 +21,9 @@ import java.util.ArrayList;
import java.util.List;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
-import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.spring.factory.AbstractComponentAwareFactoryBean;
import org.opensaml.security.trust.TrustEngine;
@@ -37,7 +38,7 @@ public class ChainingTrustEngineFactoryBean extends
AbstractComponentAwareFactoryBean<ChainingTrustEngine<?>> {
/** The unfiltered list of putative trust engines. */
- private final List<Object> engines;
+ @Nullable private final List<Object> engines;
/**
* Constructor.
@@ -45,19 +46,26 @@ public class ChainingTrustEngineFactoryBean extends
* @param list the putative trust engines.
*/
public ChainingTrustEngineFactoryBean(@Nonnull final List<Object> list) {
- engines = Constraint.isNotNull(list, "Engine list must be non null");
+ engines = list;
}
/** {@inheritDoc} */
- @Override public Class<?> getObjectType() {
+ @Override @Nonnull public Class<?> getObjectType() {
return ChainingTrustEngine.class;
}
/** {@inheritDoc} */
@SuppressWarnings({"rawtypes", "unchecked"})
- @Override protected ChainingTrustEngine<?> doCreateInstance() throws Exception {
+ @Override
+ @Nonnull protected ChainingTrustEngine<?> doCreateInstance() throws Exception {
+
+ if (engines == null) {
+ return new ChainingTrustEngine(CollectionSupport.emptyList());
+ }
+
+ assert engines != null;
final List<TrustEngine<?>> list = new ArrayList<>(engines.size());
-
+ assert engines != null;
for (final Object engine : engines) {
if (engine instanceof TrustEngine) {
list.add((TrustEngine<?>) engine);
diff --git a/opensaml-spring/src/main/java/org/opensaml/spring/trust/PKIXInlineValidationInfoFactoryBean.java b/opensaml-spring/src/main/java/org/opensaml/spring/trust/PKIXInlineValidationInfoFactoryBean.java
index 36f4ec0ce..7704b6508 100644
--- a/opensaml-spring/src/main/java/org/opensaml/spring/trust/PKIXInlineValidationInfoFactoryBean.java
+++ b/opensaml-spring/src/main/java/org/opensaml/spring/trust/PKIXInlineValidationInfoFactoryBean.java
@@ -24,26 +24,28 @@ import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.List;
+import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.security.x509.X509Support;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import org.springframework.beans.FatalBeanException;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* File system specific bean for PKIXValidationInfo.
*/
public class PKIXInlineValidationInfoFactoryBean extends AbstractBasicPKIXValidationInfoFactoryBean {
/** log. */
- private Logger log = LoggerFactory.getLogger(PKIXInlineValidationInfoFactoryBean.class);
+ @Nonnull private Logger log = LoggerFactory.getLogger(PKIXInlineValidationInfoFactoryBean.class);
/** The strings to be turned into the certificates. */
- private List<String> certificateFiles;
+ @Nullable private List<String> certificateFiles;
/** The strings to be turned into the crls. */
- private List<String> crlStrings;
+ @Nullable private List<String> crlStrings;
/**
* Set the file names which we will convert into certificates.
@@ -72,7 +74,10 @@ public class PKIXInlineValidationInfoFactoryBean extends AbstractBasicPKIXValida
if (null == certificateFiles) {
return null;
}
+
+ assert certificateFiles != null;
final List<X509Certificate> certificates = new ArrayList<>(certificateFiles.size());
+ assert certificateFiles != null;
for (final String cert : certificateFiles) {
try {
certificates.add(X509Support.decodeCertificate(cert.trim()));
@@ -93,9 +98,12 @@ public class PKIXInlineValidationInfoFactoryBean extends AbstractBasicPKIXValida
if (null == crlStrings) {
return null;
}
+ assert crlStrings != null;
final List<X509CRL> crls = new ArrayList<>(crlStrings.size());
+ assert crlStrings != null;
for (final String crl : crlStrings) {
try {
+ assert crl != null;
crls.add(X509Support.decodeCRL(crl));
} catch (final CRLException | CertificateException e) {
log.error("{}: Could not decode provided CRL: {}", getConfigDescription(), e.getMessage());
diff --git a/opensaml-spring/src/main/java/org/opensaml/spring/trust/PKIXResourceValidationInfoFactoryBean.java b/opensaml-spring/src/main/java/org/opensaml/spring/trust/PKIXResourceValidationInfoFactoryBean.java
index 52371d63e..7b30f6383 100644
--- a/opensaml-spring/src/main/java/org/opensaml/spring/trust/PKIXResourceValidationInfoFactoryBean.java
+++ b/opensaml-spring/src/main/java/org/opensaml/spring/trust/PKIXResourceValidationInfoFactoryBean.java
@@ -26,27 +26,30 @@ import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.List;
+import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.security.x509.X509Support;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
import org.springframework.beans.FatalBeanException;
import org.springframework.core.io.Resource;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
/**
* File system specific bean for PKIXValidationInfo.
*/
public class PKIXResourceValidationInfoFactoryBean extends AbstractBasicPKIXValidationInfoFactoryBean {
/** log. */
- private Logger log = LoggerFactory.getLogger(PKIXResourceValidationInfoFactoryBean.class);
+ @Nonnull private Logger log = LoggerFactory.getLogger(PKIXResourceValidationInfoFactoryBean.class);
/** The file to be turned into the certificates. */
- private List<Resource> certificateFiles;
+ @Nullable private List<Resource> certificateFiles;
/** The file to be turned into the crls. */
- private List<Resource> crlFiles;
+ @Nullable private List<Resource> crlFiles;
/**
* Set the file names which we will convert into certificates.
@@ -75,7 +78,9 @@ public class PKIXResourceValidationInfoFactoryBean extends AbstractBasicPKIXVali
if (null == certificateFiles) {
return null;
}
+ assert certificateFiles != null;
final List<X509Certificate> certificates = new ArrayList<>(certificateFiles.size());
+ assert certificateFiles != null;
for (final Resource f : certificateFiles) {
try(InputStream is = f.getInputStream()) {
certificates.addAll(X509Support.decodeCertificates(is));
@@ -97,7 +102,9 @@ public class PKIXResourceValidationInfoFactoryBean extends AbstractBasicPKIXVali
if (null == crlFiles) {
return null;
}
+ assert crlFiles != null;
final List<X509CRL> crls = new ArrayList<>(crlFiles.size());
+ assert crlFiles != null;
for (final Resource crlFile : crlFiles) {
try(InputStream is = crlFile.getInputStream()) {
crls.addAll(X509Support.decodeCRLs(is));
diff --git a/opensaml-spring/src/main/java/org/opensaml/spring/trust/StaticExplicitKeyFactoryBean.java b/opensaml-spring/src/main/java/org/opensaml/spring/trust/StaticExplicitKeyFactoryBean.java
index 1ce3f4252..c620c0061 100644
--- a/opensaml-spring/src/main/java/org/opensaml/spring/trust/StaticExplicitKeyFactoryBean.java
+++ b/opensaml-spring/src/main/java/org/opensaml/spring/trust/StaticExplicitKeyFactoryBean.java
@@ -23,7 +23,6 @@ import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Collection;
-import java.util.Collections;
import java.util.List;
import javax.annotation.Nonnull;
@@ -39,11 +38,13 @@ import org.opensaml.security.trust.impl.ExplicitKeyTrustEngine;
import org.opensaml.security.x509.BasicX509Credential;
import org.opensaml.security.x509.X509Support;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
import org.springframework.beans.FatalBeanException;
import org.springframework.core.io.Resource;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.spring.factory.AbstractComponentAwareFactoryBean;
/**
@@ -57,15 +58,15 @@ public class StaticExplicitKeyFactoryBean extends AbstractComponentAwareFactoryB
@Nonnull private Logger log = LoggerFactory.getLogger(StaticExplicitKeyFactoryBean.class);
/** The resources to be turned into keys. */
- private List<Resource> keyResources;
+ @Nonnull private List<Resource> keyResources;
/** The resources to be turned into certificates. */
- private List<Resource> certificateResources;
+ @Nonnull private List<Resource> certificateResources;
/** Constructor. */
public StaticExplicitKeyFactoryBean() {
- keyResources = Collections.emptyList();
- certificateResources = Collections.emptyList();
+ keyResources = CollectionSupport.emptyList();
+ certificateResources = CollectionSupport.emptyList();
}
/**
@@ -74,7 +75,7 @@ public class StaticExplicitKeyFactoryBean extends AbstractComponentAwareFactoryB
* @param keys the resources
*/
public void setPublicKeys(@Nullable final List<Resource> keys) {
- keyResources = keys != null ? keys : Collections.emptyList();
+ keyResources = keys != null ? keys : CollectionSupport.emptyList();
}
/**
@@ -83,7 +84,7 @@ public class StaticExplicitKeyFactoryBean extends AbstractComponentAwareFactoryB
* @param certs the resources
*/
public void setCertificates(@Nullable final List<Resource> certs) {
- certificateResources = certs != null ? certs : Collections.emptyList();
+ certificateResources = certs != null ? certs : CollectionSupport.emptyList();
}
/**
@@ -91,7 +92,7 @@ public class StaticExplicitKeyFactoryBean extends AbstractComponentAwareFactoryB
*
* @return the certificates null
*/
- @Nullable @NonnullElements protected List<Credential> getCredentials() {
+ @Nonnull @NonnullElements protected List<Credential> getCredentials() {
final List<Credential> credentials = new ArrayList<>(keyResources.size() + certificateResources.size());
@@ -127,13 +128,13 @@ public class StaticExplicitKeyFactoryBean extends AbstractComponentAwareFactoryB
/** {@inheritDoc} */
@Override
- public Class<?> getObjectType() {
+ @Nonnull public Class<?> getObjectType() {
return ExplicitKeyTrustEngine.class;
}
/** {@inheritDoc} */
@Override
- protected ExplicitKeyTrustEngine doCreateInstance() throws Exception {
+ @Nonnull protected ExplicitKeyTrustEngine doCreateInstance() throws Exception {
return new ExplicitKeyTrustEngine(new StaticCredentialResolver(getCredentials()));
}
diff --git a/opensaml-spring/src/main/java/org/opensaml/spring/trust/StaticPKIXFactoryBean.java b/opensaml-spring/src/main/java/org/opensaml/spring/trust/StaticPKIXFactoryBean.java
index 801df53d1..eab84d3ee 100644
--- a/opensaml-spring/src/main/java/org/opensaml/spring/trust/StaticPKIXFactoryBean.java
+++ b/opensaml-spring/src/main/java/org/opensaml/spring/trust/StaticPKIXFactoryBean.java
@@ -43,11 +43,13 @@ import org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine;
import org.opensaml.security.x509.impl.StaticPKIXValidationInformationResolver;
import org.opensaml.security.x509.impl.X509CredentialNameEvaluator;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
import org.springframework.beans.FatalBeanException;
import org.springframework.core.io.Resource;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
import net.shibboleth.shared.spring.factory.AbstractComponentAwareFactoryBean;
@@ -91,7 +93,7 @@ public class StaticPKIXFactoryBean extends AbstractComponentAwareFactoryBean<PKI
/** {@inheritDoc} */
@Override
- public Class<?> getObjectType() {
+ @Nonnull public Class<?> getObjectType() {
return PKIXX509CredentialTrustEngine.class;
}
@@ -118,7 +120,7 @@ public class StaticPKIXFactoryBean extends AbstractComponentAwareFactoryBean<PKI
*
* @param depth value to set
*/
- public void setVerifyDepth(final int depth) {
+ public void setVerifyDepth(@Nullable final Integer depth) {
verifyDepth = depth;
}
@@ -187,10 +189,12 @@ public class StaticPKIXFactoryBean extends AbstractComponentAwareFactoryBean<PKI
*/
@Nonnull @NonnullElements protected List<X509Certificate> getCertificates() {
if (certificateResources == null) {
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
+ assert certificateResources != null;
final List<X509Certificate> certificates = new ArrayList<>(certificateResources.size());
+ assert certificateResources != null;
for (final Resource f : certificateResources) {
try(final InputStream is = f.getInputStream()) {
certificates.addAll(X509Support.decodeCertificates(is));
@@ -209,10 +213,12 @@ public class StaticPKIXFactoryBean extends AbstractComponentAwareFactoryBean<PKI
*/
@Nonnull @NonnullElements protected List<X509CRL> getCRLs() {
if (crlResources == null) {
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
+ assert crlResources != null;
final List<X509CRL> crls = new ArrayList<>(crlResources.size());
+ assert crlResources != null;
for (final Resource crlFile : crlResources) {
try(final InputStream is = crlFile.getInputStream()) {
crls.addAll(X509Support.decodeCRLs(is));
@@ -226,7 +232,7 @@ public class StaticPKIXFactoryBean extends AbstractComponentAwareFactoryBean<PKI
/** {@inheritDoc} */
@Override
- protected PKIXX509CredentialTrustEngine doCreateInstance() throws Exception {
+ @Nonnull protected PKIXX509CredentialTrustEngine doCreateInstance() throws Exception {
final BasicPKIXValidationInformation info =
new BasicPKIXValidationInformation(getCertificates(), getCRLs(), verifyDepth);
diff --git a/opensaml-spring/src/test/java/org/opensaml/spring/credential/BasicX509CredentialFactoryBeanTest.java b/opensaml-spring/src/test/java/org/opensaml/spring/credential/BasicX509CredentialFactoryBeanTest.java
index ff2ca0f14..cb2e474fd 100644
--- a/opensaml-spring/src/test/java/org/opensaml/spring/credential/BasicX509CredentialFactoryBeanTest.java
+++ b/opensaml-spring/src/test/java/org/opensaml/spring/credential/BasicX509CredentialFactoryBeanTest.java
@@ -22,6 +22,7 @@ import org.springframework.context.support.GenericApplicationContext;
import org.testng.Assert;
import org.testng.annotations.Test;
+import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.spring.context.FilesystemGenericApplicationContext;
import net.shibboleth.shared.spring.custom.SchemaTypeAwareXMLBeanDefinitionReader;
@@ -30,6 +31,9 @@ import net.shibboleth.shared.spring.custom.SchemaTypeAwareXMLBeanDefinitionReade
*/
public class BasicX509CredentialFactoryBeanTest {
+ /**
+ * Test.
+ */
@Test public void bean() {
final GenericApplicationContext context = new FilesystemGenericApplicationContext();
context.setDisplayName("ApplicationContext: X509Credential");
@@ -46,8 +50,8 @@ public class BasicX509CredentialFactoryBeanTest {
Assert.assertEquals("http://example.org/enc", cred2.getEntityId());
- final byte[] cb1 = cred1.getPrivateKey().getEncoded();
- final byte[] cb2 = cred2.getPrivateKey().getEncoded();
+ final byte[] cb1 = Constraint.isNotNull(cred1.getPrivateKey(), "Private key was null").getEncoded();
+ final byte[] cb2 = Constraint.isNotNull(cred2.getPrivateKey(), "Private key was null").getEncoded();
Assert.assertEquals(cb1.length, cb2.length);
diff --git a/opensaml-spring/src/test/java/org/opensaml/spring/trust/AbstractSecurityTest.java b/opensaml-spring/src/test/java/org/opensaml/spring/trust/AbstractSecurityTest.java
index 29368f33c..9f0c07b3d 100644
--- a/opensaml-spring/src/test/java/org/opensaml/spring/trust/AbstractSecurityTest.java
+++ b/opensaml-spring/src/test/java/org/opensaml/spring/trust/AbstractSecurityTest.java
@@ -19,8 +19,6 @@
package org.opensaml.spring.trust;
import java.io.IOException;
-import java.util.Arrays;
-import java.util.Collections;
import org.springframework.context.support.GenericApplicationContext;
import org.springframework.core.io.ClassPathResource;
@@ -29,6 +27,7 @@ import org.springframework.mock.env.MockPropertySource;
import org.testng.annotations.AfterMethod;
import org.testng.annotations.BeforeSuite;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.spring.util.ApplicationContextBuilder;
/**
@@ -81,9 +80,9 @@ public class AbstractSecurityTest {
final MockPropertySource mockEnvVars = new MockPropertySource();
mockEnvVars.setProperty("DIR", workspaceDirName);
- builder.setPropertySources(Collections.singletonList(mockEnvVars));
+ builder.setPropertySources(CollectionSupport.singletonList(mockEnvVars));
- builder.setServiceConfigurations(Arrays.asList(resources));
+ builder.setServiceConfigurations(CollectionSupport.arrayAsList(resources));
final GenericApplicationContext context = builder.build();
diff --git a/opensaml-spring/src/test/java/org/opensaml/spring/trust/MockTrustEngine.java b/opensaml-spring/src/test/java/org/opensaml/spring/trust/MockTrustEngine.java
index fb8bea2f2..3f89525e7 100644
--- a/opensaml-spring/src/test/java/org/opensaml/spring/trust/MockTrustEngine.java
+++ b/opensaml-spring/src/test/java/org/opensaml/spring/trust/MockTrustEngine.java
@@ -17,6 +17,8 @@
package org.opensaml.spring.trust;
+import javax.annotation.Nullable;
+
import org.opensaml.security.SecurityException;
import org.opensaml.security.trust.TrustEngine;
@@ -37,8 +39,8 @@ public class MockTrustEngine<T> implements TrustEngine<T> {
}
/** {@inheritDoc} */
- @Override public boolean validate(T token, CriteriaSet trustBasisCriteria) throws SecurityException {
+ @Override public boolean validate(@Nullable final T token, @Nullable CriteriaSet trustBasisCriteria) throws SecurityException {
return result;
}
-}
+}
\ No newline at end of file
diff --git a/opensaml-spring/src/test/java/org/opensaml/spring/trust/StaticExplicitKeyFactoryBeanTest.java b/opensaml-spring/src/test/java/org/opensaml/spring/trust/StaticExplicitKeyFactoryBeanTest.java
index e0498fb62..683533700 100644
--- a/opensaml-spring/src/test/java/org/opensaml/spring/trust/StaticExplicitKeyFactoryBeanTest.java
+++ b/opensaml-spring/src/test/java/org/opensaml/spring/trust/StaticExplicitKeyFactoryBeanTest.java
@@ -43,8 +43,8 @@ public class StaticExplicitKeyFactoryBeanTest extends AbstractSecurityTest {
final ExplicitKeyTrustEngine engine = (ExplicitKeyTrustEngine) getBean("staticKeySingle", TrustEngine.class, TESTPATH);
final StaticCredentialResolver resolver = (StaticCredentialResolver) engine.getCredentialResolver();
- Credential credential = resolver.resolveSingle(null);
-
+ final Credential credential = resolver.resolveSingle(null);
+ assert credential != null;
Assert.assertNotNull(credential.getPublicKey());
}
@@ -52,7 +52,8 @@ public class StaticExplicitKeyFactoryBeanTest extends AbstractSecurityTest {
final ExplicitKeyTrustEngine engine = (ExplicitKeyTrustEngine) getBean("staticX509Single", TrustEngine.class, TESTPATH);
final StaticCredentialResolver resolver = (StaticCredentialResolver) engine.getCredentialResolver();
- X509Credential credential = (X509Credential) resolver.resolveSingle(null);
+ final X509Credential credential = (X509Credential) resolver.resolveSingle(null);
+ assert credential != null;
Assert.assertEquals(credential.getEntityCertificateChain().size(), 1);
Assert.assertTrue(credential.getEntityCertificateChain().contains(credential.getEntityCertificate()));
@@ -65,7 +66,7 @@ public class StaticExplicitKeyFactoryBeanTest extends AbstractSecurityTest {
final StaticCredentialResolver resolver = (StaticCredentialResolver) engine.getCredentialResolver();
- Iterator<Credential> credentials = resolver.resolve(null).iterator();
+ final Iterator<Credential> credentials = resolver.resolve(null).iterator();
Assert.assertTrue(credentials.hasNext());
final X509Credential first = (X509Credential) credentials.next();
@@ -81,7 +82,7 @@ public class StaticExplicitKeyFactoryBeanTest extends AbstractSecurityTest {
final StaticCredentialResolver resolver = (StaticCredentialResolver) engine.getCredentialResolver();
- Iterator<Credential> credentials = resolver.resolve(null).iterator();
+ final Iterator<Credential> credentials = resolver.resolve(null).iterator();
Assert.assertTrue(credentials.hasNext());
final Credential first = credentials.next();
diff --git a/opensaml-spring/src/test/java/org/opensaml/spring/trust/StaticPKIXFactoryBeanTest.java b/opensaml-spring/src/test/java/org/opensaml/spring/trust/StaticPKIXFactoryBeanTest.java
index b28ace672..102868bf5 100644
--- a/opensaml-spring/src/test/java/org/opensaml/spring/trust/StaticPKIXFactoryBeanTest.java
+++ b/opensaml-spring/src/test/java/org/opensaml/spring/trust/StaticPKIXFactoryBeanTest.java
@@ -19,6 +19,9 @@ package org.opensaml.spring.trust;
import java.util.Set;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.opensaml.security.SecurityException;
import org.opensaml.security.x509.PKIXTrustEvaluator;
import org.opensaml.security.x509.PKIXValidationInformation;
@@ -41,6 +44,7 @@ import net.shibboleth.shared.spring.custom.SchemaTypeAwareXMLBeanDefinitionReade
/**
* Unit test for {@link StaticPKIXFactoryBean}.
*/
+ at SuppressWarnings("javadoc")
public class StaticPKIXFactoryBeanTest {
@Test
@@ -109,14 +113,14 @@ public class StaticPKIXFactoryBeanTest {
public static class MockPKIXTrustEvaluator extends AbstractInitializableComponent implements PKIXTrustEvaluator {
/** {@inheritDoc} */
- public boolean validate(PKIXValidationInformation validationInfo, X509Credential untrustedCredential)
- throws SecurityException {
+ public boolean validate(@Nonnull final PKIXValidationInformation validationInfo,
+ @Nonnull final X509Credential untrustedCredential) throws SecurityException {
return false;
}
/** {@inheritDoc} */
- public PKIXValidationOptions getPKIXValidationOptions() {
- return null;
+ @Nonnull public PKIXValidationOptions getPKIXValidationOptions() {
+ throw new UnsupportedOperationException();
}
}
@@ -124,7 +128,8 @@ public class StaticPKIXFactoryBeanTest {
public static class MockX509CredentialNameEvaluator extends AbstractInitializableComponent implements X509CredentialNameEvaluator {
/** {@inheritDoc} */
- public boolean evaluate(X509Credential credential, Set<String> trustedNames) throws SecurityException {
+ public boolean evaluate(@Nonnull final X509Credential credential, @Nullable final Set<String> trustedNames)
+ throws SecurityException {
return false;
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list