[java-oidc-common] branch main updated: Fix a NPE when no data encryption algorithm is set.

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=6568bba78facef4ccaf1d1afb3b8912e57f3df49

The following commit(s) were added to refs/heads/main by this push:
     new 6568bba  Fix a NPE when no data encryption algorithm is set.
6568bba is described below

commit 6568bba78facef4ccaf1d1afb3b8912e57f3df49
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Mar 17 17:57:14 2023 +0200

    Fix a NPE when no data encryption algorithm is set.
---
 .../impl/DefaultEncryptionParametersResolver.java  |  4 +++
 .../DefaultEncryptionParametersResolverTest.java   | 42 ++++++++++++++++++----
 2 files changed, 40 insertions(+), 6 deletions(-)

diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolver.java
index 4495296..7e206d5 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolver.java
@@ -530,6 +530,10 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
         
         log.debug("Looking for encryption parameters for algorithm '{}'", algorithm);
         final EncryptionMethod encryptionMethod = resolveEncryptionMethod(dataEncryptionAlgorithms);
+        if (encryptionMethod == null) {
+            log.debug("Could not resolve encryption method");
+            return false;
+        }
         
         final List<Credential> keyTransportCredentials = getEffectiveKeyTransportCredentials(
                 buildKeyManagmentAlgorithmCriteria(criteria, algorithm, encryptionMethod));
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolverTest.java
index ddb1020..502c423 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolverTest.java
@@ -125,20 +125,28 @@ public class DefaultEncryptionParametersResolverTest {
     
     
     
-    private CriteriaSet buildBasicCriteriaSet() throws Exception {        
+    private CriteriaSet buildBasicCriteriaSet() throws Exception {
+        return buildBasicCriteriaSet(true);
+    }
+
+    private CriteriaSet buildBasicCriteriaSet(final boolean addDataEncryptionAlgs) throws Exception {        
         
         config = new BasicEncryptionConfiguration();
         config.setKeyTransportEncryptionAlgorithms(
                 List.of(KeyManagementConstants.ALGO_ID_ALG_AES_128_KW, KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256,
                 KeyManagementConstants.ALGO_ID_ALG_ECDH_ES_AES_192_KW, KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP));
-        config.setDataEncryptionAlgorithms(
-                List.of(EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256,EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM,
-                        EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512));
+        if (addDataEncryptionAlgs) {
+            config.setDataEncryptionAlgorithms(
+                    List.of(EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256,EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM,
+                            EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512));
+        } else {
+            config.setDataEncryptionAlgorithms(Collections.emptyList());
+        }
         final CriteriaSet criteria = new CriteriaSet(new EncryptionConfigurationCriterion(List.of(config)));   
         criteria.add(new UsageCriterion(UsageType.ENCRYPTION));
         return criteria;
     }
-    
+
     @Test
     public void testBasicRSA() throws Exception {
         final CriteriaSet criteria =  buildBasicCriteriaSet();
@@ -170,7 +178,29 @@ public class DefaultEncryptionParametersResolverTest {
         assertEquals(param.getKeyTransportEncryptionCredential().getPublicKey().getAlgorithm(),"RSA");
        
     }
-    
+
+    @Test
+    public void testBasicRSA_noDataEncryptionAlgs() throws Exception {
+        final CriteriaSet criteria =  buildBasicCriteriaSet(false);
+        config.setKeyTransportEncryptionAlgorithms(
+                List.of(KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256));        
+        
+        final List<Credential> creds = new ArrayList<>();
+        final RSAKey key = new RSAKeyGenerator(2048)
+                .algorithm(JWEAlgorithm.RSA_OAEP_256)
+                .keyUse(KeyUse.ENCRYPTION)
+                .keyID("mock-key-rsa")
+                .generate();
+        creds.add(TestCredentialHelper.createKeyEncryptionCredential(key));
+        creds.add(TestCredentialHelper.createClientSecretCredential(SYMMETRIC_KEY)
+                .toEncryptionCredential(JWEAlgorithm.A256KW, EncryptionMethod.A128CBC_HS256));
+
+        
+        config.setKEKCredentialResolver(new MockStaticFilteringCredentialResolver(creds));
+        
+        assertNull(resolver.resolveSingle(criteria));
+    }
+
     @Test
     public void testBasicRSA_WrongAlgorithmInConfig() throws Exception {
         final CriteriaSet criteria =  buildBasicCriteriaSet();

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.