[java-opensaml] branch main updated: OSJ-414 Suspicious comparison of Integer references in AttributeConsumingServiceSelector OSR-415 Suspicious comparison of Boolean references in SAML2AuthnRequestsSignedSecurityHandler

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=8f78ede095e49ffd312d1879ffc367fa66338c2e

The following commit(s) were added to refs/heads/main by this push:
     new 8f78ede09 OSJ-414 Suspicious comparison of Integer references in AttributeConsumingServiceSelector OSR-415 Suspicious comparison of Boolean references in SAML2AuthnRequestsSignedSecurityHandler
8f78ede09 is described below

commit 8f78ede095e49ffd312d1879ffc367fa66338c2e
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Tue Mar 4 15:08:26 2025 +0000

    OSJ-414 Suspicious comparison of Integer references in AttributeConsumingServiceSelector
    OSR-415 Suspicious comparison of Boolean references in SAML2AuthnRequestsSignedSecurityHandler
    
    https://shibboleth.atlassian.net/browse/OSJ-415
    https://shibboleth.atlassian.net/browse/OSJ-416
    
    In both cases replace
    
       if (foo == methodCall())
    
    with
    
       if (foo.equals(methodCall()))
    
    (with appropriate null guarding)
---
 .../saml/metadata/support/AttributeConsumingServiceSelector.java        | 2 +-
 .../binding/security/impl/SAML2AuthnRequestsSignedSecurityHandler.java  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/AttributeConsumingServiceSelector.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/AttributeConsumingServiceSelector.java
index 522560d5c..1f67c3389 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/AttributeConsumingServiceSelector.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/AttributeConsumingServiceSelector.java
@@ -211,7 +211,7 @@ public class AttributeConsumingServiceSelector {
             // Check for null b/c don't ever want to fail with an NPE due to autoboxing.
             // Note: metadata index property is an int, not an Integer.
             if (index != null) {
-                if (index == attribCS.getIndex()) {
+                if (index.equals(attribCS.getIndex())) {
                     log.debug("Selected AttributeConsumingService with index: {}", index);
                     return attribCS;
                 }
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/SAML2AuthnRequestsSignedSecurityHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/SAML2AuthnRequestsSignedSecurityHandler.java
index 12ccdc2e1..a838a93af 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/SAML2AuthnRequestsSignedSecurityHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/SAML2AuthnRequestsSignedSecurityHandler.java
@@ -102,7 +102,7 @@ public class SAML2AuthnRequestsSignedSecurityHandler extends AbstractMessageHand
         
         final SPSSODescriptor spssoRole = (SPSSODescriptor) metadataContext.getRoleDescriptor();
         assert spssoRole != null;
-        if (spssoRole.isAuthnRequestsSigned() == Boolean.TRUE) {
+        if (Boolean.TRUE.equals(spssoRole.isAuthnRequestsSigned())) {
             log.debug("SPSSODescriptor for entity ID '{}' indicates AuthnRequests must be signed", messageIssuer);
             return true;
         }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.