[java-opensaml] branch main updated: IDP-2069 - Null Handling Task
Scott Cantor
cantor.2 at osu.edu
Mon May 1 19:01:21 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=17bddd21667f7974201a854cdb25bede51ac4adf
The following commit(s) were added to refs/heads/main by this push:
new 17bddd216 IDP-2069 - Null Handling Task
17bddd216 is described below
commit 17bddd21667f7974201a854cdb25bede51ac4adf
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon May 1 15:01:18 2023 -0400
IDP-2069 - Null Handling Task
https://shibboleth.atlassian.net/browse/IDP-2069
Add some missing annotations.
Adjust a couple of nullable APIs after review.
Remove public keywords from interfaces.
---
.../core/xml/ElementExtensibleXMLObject.java | 7 ++++--
.../HttpClientSecurityConfigurationCriterion.java | 5 ++--
.../httpclient/HttpClientSecurityConstants.java | 17 ++++++++-----
.../HttpClientSecurityContextHandler.java | 8 +++++--
.../httpclient/HttpClientSecuritySupport.java | 4 ++--
.../messaging/HttpClientSecurityContext.java | 4 ++--
.../ServletRequestX509CredentialAdapter.java | 3 ++-
.../org/opensaml/security/trust/TrustEngine.java | 2 +-
.../trust/TrustedCredentialTrustEngine.java | 2 +-
.../opensaml/security/x509/PKIXTrustEvaluator.java | 4 ++--
.../security/x509/PKIXValidationInformation.java | 8 +++++--
.../x509/PKIXValidationInformationResolver.java | 12 ++++++----
.../security/x509/PKIXValidationOptions.java | 6 ++---
.../security/x509/X509IssuerSerialCriterion.java | 14 +++++------
.../x509/X509SubjectKeyIdentifierCriterion.java | 7 ++++--
.../security/x509/X509SubjectNameCriterion.java | 7 +++---
.../x509/tls/ClientTLSValidationConfiguration.java | 4 ++--
.../ClientTLSValidationConfigurationCriterion.java | 7 ++++--
.../tls/ClientTLSValidationParametersResolver.java | 2 +-
.../x509/impl/BasicPKIXValidationInformation.java | 28 ++++++++++++----------
.../x509/impl/CertPathPKIXTrustEvaluator.java | 7 +++---
.../x509/impl/CertPathPKIXValidationOptions.java | 22 +++++++++++------
.../x509/impl/KeyStoreX509CredentialAdapter.java | 3 ---
.../x509/impl/PKIXX509CredentialTrustEngine.java | 7 +++---
.../x509/impl/X509CredentialNameEvaluator.java | 6 +++--
.../opensaml/xmlsec/keyinfo/KeyInfoSupport.java | 5 ++--
26 files changed, 118 insertions(+), 83 deletions(-)
diff --git a/opensaml-core-api/src/main/java/org/opensaml/core/xml/ElementExtensibleXMLObject.java b/opensaml-core-api/src/main/java/org/opensaml/core/xml/ElementExtensibleXMLObject.java
index 2867425d2..b3338c75c 100644
--- a/opensaml-core-api/src/main/java/org/opensaml/core/xml/ElementExtensibleXMLObject.java
+++ b/opensaml-core-api/src/main/java/org/opensaml/core/xml/ElementExtensibleXMLObject.java
@@ -22,6 +22,9 @@ import java.util.List;
import javax.annotation.Nonnull;
import javax.xml.namespace.QName;
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
+
/**
* An XMLObject whose content model contains "any" child elements.
*/
@@ -32,7 +35,7 @@ public interface ElementExtensibleXMLObject extends XMLObject {
*
* @return list of XMLObjects added to this XMLObject as part of the "any" content model
*/
- @Nonnull public List<XMLObject> getUnknownXMLObjects();
+ @Nonnull @NonnullElements @Live public List<XMLObject> getUnknownXMLObjects();
/**
* Gets the list of XMLObjects added to this XMLObject as part of the "any" content model,
@@ -43,5 +46,5 @@ public interface ElementExtensibleXMLObject extends XMLObject {
*
* TODO: think this should be typed List<? extends XMLObject>
*/
- @Nonnull public List<XMLObject> getUnknownXMLObjects(@Nonnull final QName typeOrName);
+ @Nonnull @NonnullElements @Live public List<XMLObject> getUnknownXMLObjects(@Nonnull final QName typeOrName);
}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfigurationCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfigurationCriterion.java
index c21843e0d..007300e0b 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfigurationCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfigurationCriterion.java
@@ -25,6 +25,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.resolver.Criterion;
@@ -44,7 +45,7 @@ public class HttpClientSecurityConfigurationCriterion implements Criterion {
public HttpClientSecurityConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty final
List<HttpClientSecurityConfiguration> configurations) {
Constraint.isNotNull(configurations, "List of configurations cannot be null");
- configs = List.copyOf(configurations);
+ configs = CollectionSupport.copyToList(configurations);
Constraint.isNotEmpty(configs, "At least one configuration is required");
}
@@ -57,7 +58,7 @@ public class HttpClientSecurityConfigurationCriterion implements Criterion {
public HttpClientSecurityConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty final
HttpClientSecurityConfiguration... configurations) {
Constraint.isNotNull(configurations, "List of configurations cannot be null");
- configs = List.of(configurations);
+ configs = CollectionSupport.listOf(configurations);
Constraint.isNotEmpty(configs, "At least one configuration is required");
}
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConstants.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConstants.java
index 9b027109f..9fed67191 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConstants.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConstants.java
@@ -41,11 +41,13 @@ public final class HttpClientSecurityConstants {
/** Context key for a server TLS credential evaluation result, populated by specialized instances
* of HttpClient socket factories. Type will be a {@link Boolean}. */
- @Nonnull @NotEmpty public static final String CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED = "opensaml.ServerTLSCredentialTrusted";
+ @Nonnull @NotEmpty
+ public static final String CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED = "opensaml.ServerTLSCredentialTrusted";
/** Context key for indicating whether server TLS evaluation failure should be treated as a fatal error.
* Type will be a {@link Boolean}. */
- @Nonnull @NotEmpty public static final String CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL = "opensaml.ServerTLSFailureIsFatal";
+ @Nonnull @NotEmpty
+ public static final String CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL = "opensaml.ServerTLSFailureIsFatal";
/** HttpContext key for the client TLS credential.
* Must be an instance of {@link org.opensaml.security.x509.X509Credential}. */
@@ -53,16 +55,19 @@ public final class HttpClientSecurityConstants {
/** HttpContext key for a a list of TLS protocols to enable on the socket.
* Must be an instance of {@link java.util.List}<code><</code>{@link String}<code>></code>. */
- @Nonnull @NotEmpty public static final String CONTEXT_KEY_TLS_PROTOCOLS = TLSSocketFactory.CONTEXT_KEY_TLS_PROTOCOLS;
+ @Nonnull @NotEmpty
+ public static final String CONTEXT_KEY_TLS_PROTOCOLS = TLSSocketFactory.CONTEXT_KEY_TLS_PROTOCOLS;
/** HttpContext key for a a list of TLS cipher suites to enable on the socket.
* Must be an instance of {@link java.util.List}<code><</code>{@link String}<code>></code>. */
- @Nonnull @NotEmpty public static final String CONTEXT_KEY_TLS_CIPHER_SUITES = TLSSocketFactory.CONTEXT_KEY_TLS_CIPHER_SUITES;
+ @Nonnull @NotEmpty
+ public static final String CONTEXT_KEY_TLS_CIPHER_SUITES = TLSSocketFactory.CONTEXT_KEY_TLS_CIPHER_SUITES;
/** HttpContext key for an instance of {@link javax.net.ssl.HostnameVerifier}. */
- @Nonnull @NotEmpty public static final String CONTEXT_KEY_HOSTNAME_VERIFIER = TLSSocketFactory.CONTEXT_KEY_HOSTNAME_VERIFIER;
+ @Nonnull @NotEmpty
+ public static final String CONTEXT_KEY_HOSTNAME_VERIFIER = TLSSocketFactory.CONTEXT_KEY_HOSTNAME_VERIFIER;
/** Constructor. */
private HttpClientSecurityConstants() {}
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityContextHandler.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityContextHandler.java
index 069a727ee..a3a1b5b5b 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityContextHandler.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityContextHandler.java
@@ -19,6 +19,7 @@ package org.opensaml.security.httpclient;
import java.io.IOException;
+import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.apache.hc.client5.http.protocol.HttpClientContext;
@@ -59,7 +60,8 @@ public class HttpClientSecurityContextHandler extends AbstractInitializableCompo
}
/** {@inheritDoc} */
- public void invokeBefore(final HttpClientContext context, final ClassicHttpRequest request) throws IOException {
+ public void invokeBefore(@Nonnull final HttpClientContext context, @Nonnull final ClassicHttpRequest request)
+ throws IOException {
checkComponentActive();
HttpClientSecuritySupport.marshalSecurityParameters(context, httpClientSecurityParameters, false);
@@ -67,7 +69,9 @@ public class HttpClientSecurityContextHandler extends AbstractInitializableCompo
}
/** {@inheritDoc} */
- public void invokeAfter(final HttpClientContext context, final ClassicHttpRequest request) throws IOException {
+ @SuppressWarnings("null")
+ public void invokeAfter(@Nonnull final HttpClientContext context, @Nonnull final ClassicHttpRequest request)
+ throws IOException {
checkComponentActive();
HttpClientSecuritySupport.checkTLSCredentialEvaluated(context, request.getScheme());
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecuritySupport.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecuritySupport.java
index 0a35254f1..0d6e3b0fb 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecuritySupport.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecuritySupport.java
@@ -39,10 +39,10 @@ import org.opensaml.security.credential.UsageType;
import org.opensaml.security.criteria.UsageCriterion;
import org.opensaml.security.x509.TrustedNamesCriterion;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
/**
@@ -51,7 +51,7 @@ import net.shibboleth.shared.resolver.CriteriaSet;
public final class HttpClientSecuritySupport {
/** Logger. */
- private static final Logger LOG = LoggerFactory.getLogger(HttpClientSecuritySupport.class);
+ @Nonnull private static final Logger LOG = LoggerFactory.getLogger(HttpClientSecuritySupport.class);
/** Constructor. */
private HttpClientSecuritySupport() {}
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/messaging/HttpClientSecurityContext.java b/opensaml-security-api/src/main/java/org/opensaml/security/messaging/HttpClientSecurityContext.java
index 4d7082297..d4f902332 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/messaging/HttpClientSecurityContext.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/messaging/HttpClientSecurityContext.java
@@ -34,10 +34,10 @@ import net.shibboleth.shared.resolver.CriteriaSet;
public final class HttpClientSecurityContext extends BaseContext {
/** The HttpClient security parameters instance. */
- private HttpClientSecurityParameters securityParameters;
+ @Nullable private HttpClientSecurityParameters securityParameters;
/** TLS criteria strategy function. */
- private Function<MessageContext,CriteriaSet> tlsCriteriaSetStrategy;
+ @Nullable private Function<MessageContext,CriteriaSet> tlsCriteriaSetStrategy;
/**
* Get the {@link HttpClientSecurityParameters} instance.
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ServletRequestX509CredentialAdapter.java b/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ServletRequestX509CredentialAdapter.java
index 34691284a..acc59cee0 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ServletRequestX509CredentialAdapter.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ServletRequestX509CredentialAdapter.java
@@ -50,7 +50,8 @@ public class ServletRequestX509CredentialAdapter extends AbstractCredential impl
@Nonnull @NotEmpty public static final String X509_CERT_REQUEST_ATTRIBUTE = "javax.servlet.request.X509Certificate";
/** Servlet request attribute to pull certificate info from. */
- @Nonnull @NotEmpty public static final String JAKARTA_X509_CERT_REQUEST_ATTRIBUTE = "jakarta.servlet.request.X509Certificate";
+ @Nonnull @NotEmpty public static final String JAKARTA_X509_CERT_REQUEST_ATTRIBUTE =
+ "jakarta.servlet.request.X509Certificate";
/** The entity certificate. */
@Nonnull private X509Certificate cert;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/trust/TrustEngine.java b/opensaml-security-api/src/main/java/org/opensaml/security/trust/TrustEngine.java
index 841c511de..87a64f597 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/trust/TrustEngine.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/trust/TrustEngine.java
@@ -44,6 +44,6 @@ public interface TrustEngine<TokenType> {
*
* @throws SecurityException thrown if there is a problem validating the security token
*/
- public boolean validate(@Nonnull final TokenType token, @Nullable final CriteriaSet trustBasisCriteria)
+ boolean validate(@Nonnull final TokenType token, @Nullable final CriteriaSet trustBasisCriteria)
throws SecurityException;
}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/trust/TrustedCredentialTrustEngine.java b/opensaml-security-api/src/main/java/org/opensaml/security/trust/TrustedCredentialTrustEngine.java
index 162ed7103..3ef1674cd 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/trust/TrustedCredentialTrustEngine.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/trust/TrustedCredentialTrustEngine.java
@@ -37,5 +37,5 @@ public interface TrustedCredentialTrustEngine<TokenType> extends TrustEngine<Tok
* @return credential resolver used to recover trusted credentials
* that may be used to validate tokens
*/
- @Nonnull public CredentialResolver getCredentialResolver();
+ @Nonnull CredentialResolver getCredentialResolver();
}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXTrustEvaluator.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXTrustEvaluator.java
index d0e26831a..c0424e44d 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXTrustEvaluator.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXTrustEvaluator.java
@@ -35,7 +35,7 @@ public interface PKIXTrustEvaluator {
* @return true if the credential can be successfully evaluated, false otherwise
* @throws SecurityException thrown if there is an error evaluating the credential
*/
- public boolean validate(@Nonnull final PKIXValidationInformation validationInfo,
+ boolean validate(@Nonnull final PKIXValidationInformation validationInfo,
@Nonnull final X509Credential untrustedCredential) throws SecurityException;
/**
@@ -43,6 +43,6 @@ public interface PKIXTrustEvaluator {
*
* @return the PKIXValidationOptions instance
*/
- @Nonnull public PKIXValidationOptions getPKIXValidationOptions();
+ @Nonnull PKIXValidationOptions getPKIXValidationOptions();
}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformation.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformation.java
index 59158d444..cf51221cb 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformation.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformation.java
@@ -23,6 +23,9 @@ import java.util.Collection;
import javax.annotation.Nullable;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+
/**
* Source of PKIX validation information such as trust anchors and CRLs.
*/
@@ -40,12 +43,13 @@ public interface PKIXValidationInformation {
*
* @return trust anchors used during PKIX validation
*/
- @Nullable public Collection<X509Certificate> getCertificates();
+ @Nullable @Unmodifiable @NotLive public Collection<X509Certificate> getCertificates();
/**
* Gets the CRLs used during PKIX validation.
*
* @return CRLs used during PKIX validation
*/
- @Nullable public Collection<X509CRL> getCRLs();
+ @Nullable @Unmodifiable @NotLive public Collection<X509CRL> getCRLs();
+
}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformationResolver.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformationResolver.java
index ed7f29bb9..5d8bf46f2 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformationResolver.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformationResolver.java
@@ -22,12 +22,16 @@ import java.util.Set;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
import net.shibboleth.shared.resolver.CriteriaSet;
+import net.shibboleth.shared.resolver.Criterion;
import net.shibboleth.shared.resolver.Resolver;
import net.shibboleth.shared.resolver.ResolverException;
/**
- * A resolver which uses {@link net.shibboleth.shared.resolver.Criterion} to resolve
+ * A resolver which uses {@link Criterion} to resolve
* {@link PKIXValidationInformation}, which will typically be used by PKIX-based trust engines.
*
* Implementations must also implement {@link #resolveTrustedNames(CriteriaSet)}, which will
@@ -46,14 +50,14 @@ public interface PKIXValidationInformationResolver extends Resolver<PKIXValidati
* @throws ResolverException thrown if there is an error resolving the trusted names
* @throws UnsupportedOperationException thrown if this optional method is not supported by the implementation
*/
- @Nonnull public Set<String> resolveTrustedNames(@Nullable final CriteriaSet criteriaSet)
- throws ResolverException;
+ @Nonnull @NonnullElements @Unmodifiable @NotLive Set<String> resolveTrustedNames(
+ @Nullable final CriteriaSet criteriaSet) throws ResolverException;
/**
* Check whether resolution of trusted names is supported.
*
* @return true if the implementation supports resolution of trusted names, otherwise false
*/
- public boolean supportsTrustedNameResolution();
+ boolean supportsTrustedNameResolution();
}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationOptions.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationOptions.java
index b4ffa8672..4c84e3d7b 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationOptions.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationOptions.java
@@ -66,7 +66,7 @@ public class PKIXValidationOptions {
* @param flag whether to process empty CRLs
*/
public void setProcessEmptyCRLs(final boolean flag) {
- this.processEmptyCRLs = flag;
+ processEmptyCRLs = flag;
}
/**
@@ -88,7 +88,7 @@ public class PKIXValidationOptions {
* @param flag whether expired CRLs should be processed
*/
public void setProcessExpiredCRLs(final boolean flag) {
- this.processExpiredCRLs = flag;
+ processExpiredCRLs = flag;
}
/**
@@ -110,7 +110,7 @@ public class PKIXValidationOptions {
* @param flag whether to process CRLs from an untrusted credential
*/
public void setProcessCredentialCRLs(final boolean flag) {
- this.processCredentialCRLs = flag;
+ processCredentialCRLs = flag;
}
/**
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509IssuerSerialCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509IssuerSerialCriterion.java
index 800820821..42dc7fe93 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509IssuerSerialCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509IssuerSerialCriterion.java
@@ -32,10 +32,10 @@ import net.shibboleth.shared.resolver.Criterion;
public final class X509IssuerSerialCriterion implements Criterion {
/** X.509 certificate issuer name. */
- private X500Principal issuerName;
+ @Nonnull private X500Principal issuerName;
/** X.509 certificate serial number. */
- private BigInteger serialNumber;
+ @Nonnull private BigInteger serialNumber;
/**
* Constructor.
@@ -44,8 +44,8 @@ public final class X509IssuerSerialCriterion implements Criterion {
* @param serial certificate serial number
*/
public X509IssuerSerialCriterion(@Nonnull final X500Principal issuer, @Nonnull final BigInteger serial) {
- setIssuerName(issuer);
- setSerialNumber(serial);
+ issuerName = Constraint.isNotNull(issuer, "Issuer principal criteria value cannot be null");
+ serialNumber = Constraint.isNotNull(serial, "Serial number criteria value cannot be null");
}
/** Get the issuer name.
@@ -62,8 +62,7 @@ public final class X509IssuerSerialCriterion implements Criterion {
* @param issuer The issuer name to set.
*/
public void setIssuerName(@Nonnull final X500Principal issuer) {
- Constraint.isNotNull(issuer, "Issuer principal criteria value cannot be null");
- this.issuerName = issuer;
+ issuerName = Constraint.isNotNull(issuer, "Issuer principal criteria value cannot be null");
}
/**
@@ -81,8 +80,7 @@ public final class X509IssuerSerialCriterion implements Criterion {
* @param serial The serial number to set.
*/
public void setSerialNumber(@Nonnull final BigInteger serial) {
- Constraint.isNotNull(serial, "Serial number criteria value cannot be null");
- this.serialNumber = serial;
+ serialNumber = Constraint.isNotNull(serial, "Serial number criteria value cannot be null");
}
/** {@inheritDoc} */
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectKeyIdentifierCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectKeyIdentifierCriterion.java
index 130a7f70f..cdcd6e3ee 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectKeyIdentifierCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectKeyIdentifierCriterion.java
@@ -30,7 +30,7 @@ import net.shibboleth.shared.resolver.Criterion;
public final class X509SubjectKeyIdentifierCriterion implements Criterion {
/** X.509 certificate subject key identifier. */
- private byte[] subjectKeyIdentifier;
+ @Nonnull private byte[] subjectKeyIdentifier;
/**
* Constructor.
@@ -38,7 +38,10 @@ public final class X509SubjectKeyIdentifierCriterion implements Criterion {
* @param ski certificate subject key identifier
*/
public X509SubjectKeyIdentifierCriterion(@Nonnull final byte[] ski) {
- setSubjectKeyIdentifier(ski);
+ if (ski == null || ski.length == 0) {
+ throw new IllegalArgumentException("Subject key identifier criteria value cannot be null or empty");
+ }
+ subjectKeyIdentifier = ski;
}
/**
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectNameCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectNameCriterion.java
index 33e71962c..7c1b5839c 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectNameCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectNameCriterion.java
@@ -30,7 +30,7 @@ import net.shibboleth.shared.resolver.Criterion;
public final class X509SubjectNameCriterion implements Criterion {
/** X.509 certificate subject name. */
- private X500Principal subjectName;
+ @Nonnull private X500Principal subjectName;
/**
* Constructor.
@@ -38,7 +38,7 @@ public final class X509SubjectNameCriterion implements Criterion {
* @param subject certificate subject name
*/
public X509SubjectNameCriterion(@Nonnull final X500Principal subject) {
- setSubjectName(subject);
+ subjectName = Constraint.isNotNull(subject, "Subject principal criteria value cannot be null");
}
/**
@@ -56,8 +56,7 @@ public final class X509SubjectNameCriterion implements Criterion {
* @param subject The subject name
*/
public void setSubjectName(@Nonnull final X500Principal subject) {
- Constraint.isNotNull(subject, "Subject principal criteria value cannot be null");
- this.subjectName = subject;
+ subjectName = Constraint.isNotNull(subject, "Subject principal criteria value cannot be null");
}
/** {@inheritDoc} */
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationConfiguration.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationConfiguration.java
index 2dab204ca..ff4ebd320 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationConfiguration.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationConfiguration.java
@@ -32,13 +32,13 @@ public interface ClientTLSValidationConfiguration {
*
* @return a trust engine instance, may be null
*/
- @Nullable public TrustEngine<? super X509Credential> getX509TrustEngine();
+ @Nullable TrustEngine<? super X509Credential> getX509TrustEngine();
/**
* Get a {@link CertificateNameOptions} instance to use when evaluating a client TLS {@link X509Credential}.
*
* @return an options instance, may be null
*/
- @Nullable public CertificateNameOptions getCertificateNameOptions();
+ @Nullable CertificateNameOptions getCertificateNameOptions();
}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationConfigurationCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationConfigurationCriterion.java
index a866c8103..98b7604e5 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationConfigurationCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationConfigurationCriterion.java
@@ -25,6 +25,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.resolver.Criterion;
@@ -43,7 +44,8 @@ public class ClientTLSValidationConfigurationCriterion implements Criterion {
*/
public ClientTLSValidationConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty final
List<ClientTLSValidationConfiguration> configurations) {
- configs = List.copyOf(Constraint.isNotNull(configurations, "List of configurations cannot be null"));
+ configs = CollectionSupport.copyToList(Constraint.isNotNull(configurations,
+ "List of configurations cannot be null"));
Constraint.isNotEmpty(configs, "At least one configuration is required");
}
@@ -54,7 +56,8 @@ public class ClientTLSValidationConfigurationCriterion implements Criterion {
*/
public ClientTLSValidationConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty final
ClientTLSValidationConfiguration... configurations) {
- configs = List.of(Constraint.isNotNull(configurations, "List of configurations cannot be null"));
+ configs = CollectionSupport.listOf(Constraint.isNotNull(configurations,
+ "List of configurations cannot be null"));
Constraint.isNotEmpty(configs, "At least one configuration is required");
}
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationParametersResolver.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationParametersResolver.java
index 20c931cef..9dba1f958 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationParametersResolver.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationParametersResolver.java
@@ -26,4 +26,4 @@ import net.shibboleth.shared.resolver.Resolver;
public interface ClientTLSValidationParametersResolver
extends Resolver<ClientTLSValidationParameters, CriteriaSet> {
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicPKIXValidationInformation.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicPKIXValidationInformation.java
index 2127b90cb..566adb42e 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicPKIXValidationInformation.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicPKIXValidationInformation.java
@@ -26,6 +26,10 @@ import javax.annotation.Nullable;
import org.opensaml.security.x509.PKIXValidationInformation;
import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
/**
* Basic implementation of {@link PKIXValidationInformation}.
@@ -33,13 +37,13 @@ import net.shibboleth.shared.annotation.ParameterName;
public class BasicPKIXValidationInformation implements PKIXValidationInformation {
/** Certs used as the trust anchors. */
- private final Collection<X509Certificate> trustAnchors;
+ @Nullable @NonnullElements private final Collection<X509Certificate> trustAnchors;
/** CRLs used during validation. */
- private final Collection<X509CRL> trustedCRLs;
+ @Nullable @NonnullElements private final Collection<X509CRL> trustedCRLs;
/** Max verification depth during PKIX validation. */
- private final Integer verificationDepth;
+ @Nullable private final Integer verificationDepth;
/**
* Constructor.
@@ -49,30 +53,28 @@ public class BasicPKIXValidationInformation implements PKIXValidationInformation
* @param depth max verification path depth
*/
public BasicPKIXValidationInformation(
- @Nullable @ParameterName(name="anchors") final Collection<X509Certificate> anchors,
- @Nullable @ParameterName(name="crls") final Collection<X509CRL> crls,
- @Nullable @ParameterName(name="depth") final Integer depth) {
+ @Nullable @NonnullElements @ParameterName(name="anchors") final Collection<X509Certificate> anchors,
+ @Nullable @NonnullElements @ParameterName(name="crls") final Collection<X509CRL> crls,
+ @Nullable @NonnullElements @ParameterName(name="depth") final Integer depth) {
verificationDepth = depth;
- trustAnchors = anchors;
- trustedCRLs = crls;
+ trustAnchors = anchors != null ? CollectionSupport.copyToList(anchors) : null;
+ trustedCRLs = crls != null ? CollectionSupport.copyToList(crls) : null;
}
/** {@inheritDoc} */
- @Override
- @Nullable public Collection<X509CRL> getCRLs() {
+ @Nullable @NonnullElements @Unmodifiable @NotLive public Collection<X509CRL> getCRLs() {
return trustedCRLs;
}
/** {@inheritDoc} */
- @Override
- @Nullable public Collection<X509Certificate> getCertificates() {
+ @Nullable @NonnullElements @Unmodifiable @NotLive public Collection<X509Certificate> getCertificates() {
return trustAnchors;
}
/** {@inheritDoc} */
- @Override
@Nullable public Integer getVerificationDepth() {
return verificationDepth;
}
+
}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluator.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluator.java
index 146d65609..b3b9c224a 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluator.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluator.java
@@ -127,7 +127,6 @@ public class CertPathPKIXTrustEvaluator implements PKIXTrustEvaluator {
}
/** {@inheritDoc} */
- @Override
public boolean validate(@Nonnull final PKIXValidationInformation validationInfo,
@Nonnull final X509Credential untrustedCredential) throws SecurityException {
@@ -144,6 +143,7 @@ public class CertPathPKIXTrustEvaluator implements PKIXTrustEvaluator {
final CertPathBuilder builder = CertPathBuilder.getInstance("PKIX");
final PKIXCertPathBuilderResult buildResult = (PKIXCertPathBuilderResult) builder.build(params);
if (log.isDebugEnabled()) {
+ assert buildResult != null;
logCertPathDebug(buildResult, untrustedCredential.getEntityCertificate());
log.debug("PKIX validation succeeded for untrusted credential: {}",
X509Support.getIdentifiersToken(untrustedCredential, getX500DNHandler()));
@@ -176,8 +176,9 @@ public class CertPathPKIXTrustEvaluator implements PKIXTrustEvaluator {
*
* @throws GeneralSecurityException thrown if the parameters can not be created
*/
- protected PKIXBuilderParameters getPKIXBuilderParameters(@Nonnull final PKIXValidationInformation validationInfo,
- @Nonnull final X509Credential untrustedCredential) throws GeneralSecurityException {
+ @Nonnull protected PKIXBuilderParameters getPKIXBuilderParameters(
+ @Nonnull final PKIXValidationInformation validationInfo, @Nonnull final X509Credential untrustedCredential)
+ throws GeneralSecurityException {
final Set<TrustAnchor> trustAnchors = getTrustAnchors(validationInfo);
if (trustAnchors == null || trustAnchors.isEmpty()) {
throw new GeneralSecurityException(
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXValidationOptions.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXValidationOptions.java
index f36a807a2..5062899c3 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXValidationOptions.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXValidationOptions.java
@@ -19,8 +19,16 @@ package org.opensaml.security.x509.impl;
import java.util.Set;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.opensaml.security.x509.PKIXValidationOptions;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
/**
* Specialization of {@link PKIXValidationOptions} which specifies options specific to a
* {@link org.opensaml.security.x509.PKIXTrustEvaluator} based on the Java CertPath API.
@@ -40,16 +48,15 @@ public class CertPathPKIXValidationOptions extends PKIXValidationOptions {
private boolean anyPolicyInhibit;
/** Acceptable policy OIDs. */
- private Set<String> initialPolicies;
+ @Nonnull private Set<String> initialPolicies;
/** Constructor. */
public CertPathPKIXValidationOptions() {
- super();
forceRevocationEnabled = false;
revocationEnabled = true;
policyMappingInhibit = false;
anyPolicyInhibit = false;
- initialPolicies = null;
+ initialPolicies = CollectionSupport.emptySet();
}
/**
@@ -152,7 +159,7 @@ public class CertPathPKIXValidationOptions extends PKIXValidationOptions {
*
* @return Returns the initialPolicies set.
*/
- public Set<String> getInitialPolicies() {
+ @Nonnull @NonnullElements @Unmodifiable @NotLive public Set<String> getInitialPolicies() {
return initialPolicies;
}
@@ -163,7 +170,8 @@ public class CertPathPKIXValidationOptions extends PKIXValidationOptions {
*
* @param newPolicies the initial set of policy identifiers (OID strings)
*/
- public void setInitialPolicies(final Set<String> newPolicies) {
- initialPolicies = newPolicies;
- }
+ public void setInitialPolicies(@Nullable @NonnullElements final Set<String> newPolicies) {
+ initialPolicies = newPolicies != null ? CollectionSupport.copyToSet(newPolicies) : CollectionSupport.emptySet();
+ }
+
}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/KeyStoreX509CredentialAdapter.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/KeyStoreX509CredentialAdapter.java
index 811c7fdfe..128cf2d51 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/KeyStoreX509CredentialAdapter.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/KeyStoreX509CredentialAdapter.java
@@ -77,13 +77,11 @@ public class KeyStoreX509CredentialAdapter extends AbstractCredential implements
}
/** {@inheritDoc} */
- @Override
@Nullable public Collection<X509CRL> getCRLs() {
return CollectionSupport.emptyList();
}
/** {@inheritDoc} */
- @Override
@Nonnull public X509Certificate getEntityCertificate() {
try {
final Certificate cert = keyStore.getCertificate(credentialAlias);
@@ -98,7 +96,6 @@ public class KeyStoreX509CredentialAdapter extends AbstractCredential implements
}
/** {@inheritDoc} */
- @Override
@Nonnull public Collection<X509Certificate> getEntityCertificateChain() {
List<X509Certificate> certsCollection = CollectionSupport.emptyList();
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java
index c7981d162..dfeaa82bf 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java
@@ -31,6 +31,7 @@ import org.opensaml.security.x509.X509Credential;
import org.slf4j.Logger;
import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
@@ -98,7 +99,6 @@ public class PKIXX509CredentialTrustEngine implements PKIXTrustEngine<X509Creden
}
/** {@inheritDoc} */
- @Override
@Nonnull public PKIXValidationInformationResolver getPKIXResolver() {
return pkixResolver;
}
@@ -129,7 +129,6 @@ public class PKIXX509CredentialTrustEngine implements PKIXTrustEngine<X509Creden
}
/** {@inheritDoc} */
- @Override
public boolean validate(@Nonnull final X509Credential untrustedCredential,
@Nullable final CriteriaSet trustBasisCriteria)
throws SecurityException {
@@ -169,7 +168,7 @@ public class PKIXX509CredentialTrustEngine implements PKIXTrustEngine<X509Creden
* against trusted names or validation information
*/
protected boolean validate(@Nonnull final X509Credential untrustedX509Credential,
- @Nullable final Set<String> trustedNames,
+ @Nullable @NonnullElements final Set<String> trustedNames,
@Nonnull final Iterable<PKIXValidationInformation> validationInfoSet) throws SecurityException {
log.debug("Beginning PKIX validation using trusted validation information");
@@ -205,7 +204,7 @@ public class PKIXX509CredentialTrustEngine implements PKIXTrustEngine<X509Creden
* @return true if evaluation is successful, false otherwise
* @throws SecurityException thrown if there is an error evaluation the credential
*/
- protected boolean checkNames(@Nullable final Set<String> trustedNames,
+ protected boolean checkNames(@Nullable @NonnullElements final Set<String> trustedNames,
@Nonnull final X509Credential untrustedCredential) throws SecurityException {
if (credNameEvaluator == null) {
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/X509CredentialNameEvaluator.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/X509CredentialNameEvaluator.java
index 93dc9140e..655eebefe 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/X509CredentialNameEvaluator.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/X509CredentialNameEvaluator.java
@@ -25,6 +25,8 @@ import javax.annotation.Nullable;
import org.opensaml.security.SecurityException;
import org.opensaml.security.x509.X509Credential;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
+
/**
* Interface for classes which evaluate an {@link X509Credential} against a
* supplied set of trusted names.
@@ -44,7 +46,7 @@ public interface X509CredentialNameEvaluator {
*
* @throws SecurityException thrown if there is an error during name evaluation
*/
- public boolean evaluate(@Nonnull final X509Credential credential, @Nullable final Set<String> trustedNames)
- throws SecurityException;
+ boolean evaluate(@Nonnull final X509Credential credential,
+ @Nullable @NonnullElements final Set<String> trustedNames) throws SecurityException;
}
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoSupport.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoSupport.java
index 6b44d601e..4c20ba189 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoSupport.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/keyinfo/KeyInfoSupport.java
@@ -91,6 +91,7 @@ import org.slf4j.Logger;
import com.google.common.base.Strings;
+import net.shibboleth.shared.annotation.constraint.Live;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.codec.Base64Support;
import net.shibboleth.shared.codec.DecodingException;
@@ -169,7 +170,7 @@ public final class KeyInfoSupport {
* @throws CertificateException thrown if there is a problem converting the X509 data into
* {@link java.security.cert.X509Certificate}s.
*/
- @Nonnull public static List<X509Certificate> getCertificates(@Nullable final KeyInfo keyInfo)
+ @Nonnull @Live public static List<X509Certificate> getCertificates(@Nullable final KeyInfo keyInfo)
throws CertificateException {
final List<X509Certificate> certList = new LinkedList<>();
@@ -195,7 +196,7 @@ public final class KeyInfoSupport {
* @throws CertificateException thrown if there is a problem converting the X509 data into
* {@link java.security.cert.X509Certificate}s.
*/
- @Nonnull public static List<X509Certificate> getCertificates(@Nullable final X509Data x509Data)
+ @Nonnull @Live public static List<X509Certificate> getCertificates(@Nullable final X509Data x509Data)
throws CertificateException {
final List<X509Certificate> certList = new LinkedList<>();
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list