[java-identity-provider] branch maint-5.1 updated: Catch runtime exceptions when serializing consent

[Tom Zeller]

This is an automated email from the git hooks/post-receive script.

tzeller pushed a commit to branch maint-5.1
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=f0ec478146bc9e983afa5b071b9fcaae3e1d0ec6

The following commit(s) were added to refs/heads/maint-5.1 by this push:
     new f0ec47814 Catch runtime exceptions when serializing consent
f0ec47814 is described below

commit f0ec478146bc9e983afa5b071b9fcaae3e1d0ec6
Author: Tom Zeller <tzeller at dragonacea.biz>
AuthorDate: Fri Jun 6 08:14:37 2025 -0500

    Catch runtime exceptions when serializing consent
    
    https://shibboleth.atlassian.net/browse/IDP-2323
---
 .../consent/storage/impl/CollectionSerializer.java | 31 +++++++++++++---------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/storage/impl/CollectionSerializer.java b/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/storage/impl/CollectionSerializer.java
index 70d78aa8c..83d3a388c 100644
--- a/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/storage/impl/CollectionSerializer.java
+++ b/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/storage/impl/CollectionSerializer.java
@@ -23,6 +23,7 @@ import java.util.Collection;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 import jakarta.json.JsonArray;
+import jakarta.json.JsonException;
 import jakarta.json.JsonReader;
 import jakarta.json.JsonReaderFactory;
 import jakarta.json.JsonString;
@@ -92,23 +93,27 @@ public class CollectionSerializer extends AbstractInitializableComponent impleme
             @Nonnull @NotEmpty final String context, @Nonnull @NotEmpty final String key,
             @Nonnull @NotEmpty final String value, @Nullable final Long expiration) throws IOException {
 
-        final JsonReader reader = readerFactory.createReader(new StringReader(value));
-        final JsonStructure st = reader.read();
-        if (!(st instanceof JsonArray)) {
-            throw new IOException("Found invalid data structure");
-        }
+        try (final JsonReader reader = readerFactory.createReader(new StringReader(value))) {
+            final JsonStructure st = reader.read();
+            if (!(st instanceof JsonArray)) {
+                throw new IOException("Found invalid data structure");
+            }
 
-        final Collection<String> collection = new ArrayList<>();
+            final Collection<String> collection = new ArrayList<>();
 
-        for (final JsonValue arrayValue : (JsonArray) st) {
-            if (arrayValue.getValueType().equals(ValueType.STRING)) {
-                collection.add(((JsonString) arrayValue).getString());
+            for (final JsonValue arrayValue : (JsonArray) st) {
+                if (arrayValue.getValueType().equals(ValueType.STRING)) {
+                    collection.add(((JsonString) arrayValue).getString());
+                }
             }
-        }
 
-        log.debug("Deserialized context '{}' key '{}' value '{}' expiration '{}' as '{}'", new Object[] {context, key,
-                value, expiration, collection,});
-        return collection;
+            log.debug("Deserialized context '{}' key '{}' value '{}' expiration '{}' as '{}'",
+                    new Object[] { context, key, value, expiration, collection, });
+            return collection;
+        } catch (final NullPointerException | ClassCastException | ArithmeticException | JsonException e) {
+            log.error("Exception while parsing consent: {}", e.getMessage());
+            throw new IOException("Found invalid data structure while parsing consent", e);
+        }
     }
 
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.