[java-opensaml] branch main updated: Fix null checking issues.
Codeberg
noreply at shibboleth.net
Wed Apr 29 14:26:58 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-opensaml.
View the commit online:
https://codeberg.org/Shibboleth/java-opensaml/commit/da8c93fbd9c3b36ffecc5f5687c4f5a94f669368
The following commit(s) were added to refs/heads/main by this push:
new da8c93fbd Fix null checking issues.
da8c93fbd is described below
commit da8c93fbd9c3b36ffecc5f5687c4f5a94f669368
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Wed Apr 29 10:26:41 2026 -0400
Fix null checking issues.
---
.../messaging/encoder/AbstractMessageEncoder.java | 7 ++++++-
.../binding/decoding/impl/HTTPArtifactDecoder.java | 5 +++++
.../saml2/binding/decoding/impl/HTTPPostDecoder.java | 5 +++++
.../decoding/impl/HTTPPostSimpleSignDecoder.java | 12 +++++++++++-
.../decoding/impl/HTTPRedirectDeflateDecoder.java | 19 +++++++++++++++++--
.../binding/encoding/impl/HTTPArtifactEncoder.java | 14 +++++++++++++-
.../resolver/filter/impl/AlgorithmFilterTest.java | 1 +
.../decoding/impl/HTTPRedirectDeflateDecoderTest.java | 1 +
...TPRedirectDeflateSignatureSecurityHandlerTest.java | 4 +++-
9 files changed, 62 insertions(+), 6 deletions(-)
diff --git a/opensaml-messaging-api/src/main/java/org/opensaml/messaging/encoder/AbstractMessageEncoder.java b/opensaml-messaging-api/src/main/java/org/opensaml/messaging/encoder/AbstractMessageEncoder.java
index 87fac9270..fa836b956 100644
--- a/opensaml-messaging-api/src/main/java/org/opensaml/messaging/encoder/AbstractMessageEncoder.java
+++ b/opensaml-messaging-api/src/main/java/org/opensaml/messaging/encoder/AbstractMessageEncoder.java
@@ -84,7 +84,12 @@ public abstract class AbstractMessageEncoder extends AbstractInitializableCompon
/** {@inheritDoc} */
public void encode() throws MessageEncodingException {
checkComponentActive();
- doEncode();
+ try {
+ doEncode();
+ } catch (final RuntimeException e) {
+ // Trap and wrap any runtime issues, generally from a web container doing odd things.
+ throw new MessageEncodingException(e);
+ }
logEncodedMessage();
}
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPArtifactDecoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPArtifactDecoder.java
index 3bacf4702..77f8118da 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPArtifactDecoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPArtifactDecoder.java
@@ -356,8 +356,13 @@ public class HTTPArtifactDecoder extends BaseSAMLHttpServletRequestDecoder imple
/** {@inheritDoc} */
protected void doDecode() throws MessageDecodingException {
+ // We should do this but probably not until V6 and the destroy changes.
+ //checkComponentActive();
final MessageContext messageContext = new MessageContext();
final HttpServletRequest request = getHttpServletRequest();
+ if (request == null) {
+ throw new MessageDecodingException("HttpServletRequest was null");
+ }
final String relayState = StringSupport.trim(request.getParameter("RelayState"));
log.debug("Decoded SAML relay state of: {}", relayState);
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostDecoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostDecoder.java
index 466d07c18..40a96f56a 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostDecoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostDecoder.java
@@ -75,8 +75,13 @@ public class HTTPPostDecoder extends BaseSAMLHttpServletRequestDecoder implement
/** {@inheritDoc} */
protected void doDecode() throws MessageDecodingException {
+ // We should do this but probably not until V6 and the destroy changes.
+ //checkComponentActive();
final MessageContext messageContext = new MessageContext();
final HttpServletRequest request = getHttpServletRequest();
+ if (request == null) {
+ throw new MessageDecodingException("HttpServletRequest was null");
+ }
if (!"POST".equalsIgnoreCase(request.getMethod())) {
throw new MessageDecodingException("This message decoder only supports the HTTP POST method");
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostSimpleSignDecoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostSimpleSignDecoder.java
index dac75508e..e84bc16c0 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostSimpleSignDecoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostSimpleSignDecoder.java
@@ -32,6 +32,7 @@ import jakarta.servlet.http.HttpServletRequest;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.codec.Base64Support;
import net.shibboleth.shared.codec.DecodingException;
+import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
/** Message decoder implementing the SAML 2.0 HTTP POST-SimpleSign binding. */
@@ -51,11 +52,15 @@ public class HTTPPostSimpleSignDecoder extends HTTPPostDecoder {
* @param messageContext the current message context
*/
protected void populateBindingContext(@Nonnull final MessageContext messageContext) {
+
+ // TODO: make this throw MessageDecoderException so we can throw out here.
+ final HttpServletRequest request = Constraint.isNotNull(getHttpServletRequest(), "HttpServletRequest was null");
+
final SAMLBindingContext bindingContext = messageContext.ensureSubcontext(SAMLBindingContext.class);
bindingContext.setBindingUri(getBindingURI());
bindingContext.setBindingDescriptor(getBindingDescriptor());
bindingContext.setHasBindingSignature(
- !Strings.isNullOrEmpty(getHttpServletRequest().getParameter("Signature")));
+ !Strings.isNullOrEmpty(request.getParameter("Signature")));
bindingContext.setIntendedDestinationEndpointURIRequired(SAMLBindingSupport.isMessageSigned(messageContext));
}
@@ -83,7 +88,12 @@ public class HTTPPostSimpleSignDecoder extends HTTPPostDecoder {
* @throws MessageDecodingException if there is a fatal issue building the signed content
*/
@Nullable protected byte[] getSignedContent() throws MessageDecodingException {
+ // We should do this but probably not until V6 and the destroy changes.
+ //checkComponentActive();
final HttpServletRequest request = getHttpServletRequest();
+ if (request == null) {
+ throw new MessageDecodingException("HttpServletRequest was null");
+ }
final StringBuilder builder = new StringBuilder();
final String samlMsg;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPRedirectDeflateDecoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPRedirectDeflateDecoder.java
index 83e5c1bbd..3faf8790d 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPRedirectDeflateDecoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPRedirectDeflateDecoder.java
@@ -45,6 +45,7 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.codec.Base64Support;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.collection.Pair;
+import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.net.URISupport;
import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
@@ -87,8 +88,13 @@ public class HTTPRedirectDeflateDecoder extends BaseSAMLHttpServletRequestDecode
/** {@inheritDoc} */
protected void doDecode() throws MessageDecodingException {
+ // We should do this but probably not until V6 and the destroy changes.
+ //checkComponentActive();
final MessageContext messageContext = new MessageContext();
final HttpServletRequest request = getHttpServletRequest();
+ if (request == null) {
+ throw new MessageDecodingException("HttpServletRequest was null");
+ }
if (!"GET".equalsIgnoreCase(request.getMethod())) {
throw new MessageDecodingException("This message decoder only supports the HTTP GET method");
@@ -165,12 +171,17 @@ public class HTTPRedirectDeflateDecoder extends BaseSAMLHttpServletRequestDecode
@Nullable private byte[] getSignedContent(@Nonnull final String samlMessageParamName,
@Nonnull final String samlMessage) throws MessageDecodingException {
+ final HttpServletRequest request = getHttpServletRequest();
+ if (request == null) {
+ throw new MessageDecodingException("HttpServletRequest was null");
+ }
+
// We need the raw non-URL-decoded query string param values for HTTP-Redirect DEFLATE simple signature
// validation.
// We have to construct a string containing the signature input by accessing the
// request directly. We can't use the decoded parameters because we need the raw
// data and URL-encoding isn't canonical.
- final String queryString = getHttpServletRequest().getQueryString();
+ final String queryString = request.getQueryString();
log.debug("Constructing signed content string from URL query string {}", queryString);
final String constructed = buildSignedContentString(queryString, samlMessageParamName, samlMessage);
@@ -307,11 +318,15 @@ public class HTTPRedirectDeflateDecoder extends BaseSAMLHttpServletRequestDecode
* @param messageContext the current message context
*/
protected void populateBindingContext(@Nonnull final MessageContext messageContext) {
+
+ // TODO: make this throw MessageDecoderException so we can throw out here.
+ final HttpServletRequest request = Constraint.isNotNull(getHttpServletRequest(), "HttpServletRequest was null");
+
final SAMLBindingContext bindingContext = messageContext.ensureSubcontext(SAMLBindingContext.class);
bindingContext.setBindingUri(getBindingURI());
bindingContext.setBindingDescriptor(bindingDescriptor);
bindingContext.setHasBindingSignature(
- !Strings.isNullOrEmpty(getHttpServletRequest().getParameter("Signature")));
+ !Strings.isNullOrEmpty(request.getParameter("Signature")));
bindingContext.setIntendedDestinationEndpointURIRequired(SAMLBindingSupport.isMessageSigned(messageContext));
}
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPArtifactEncoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPArtifactEncoder.java
index 20cd05454..9e233b9e3 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPArtifactEncoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPArtifactEncoder.java
@@ -214,7 +214,13 @@ public class HTTPArtifactEncoder extends BaseSAML2MessageEncoder implements HTML
/** {@inheritDoc} */
@Override
protected void doEncode() throws MessageEncodingException {
- getHttpServletResponse().setCharacterEncoding("UTF-8");
+ // We should do this but probably not until V6 and the destroy changes.
+ //checkComponentActive();
+ final HttpServletResponse response = getHttpServletResponse();
+ if (response == null) {
+ throw new MessageEncodingException("HttpServletResponse was null");
+ }
+ response.setCharacterEncoding("UTF-8");
if (postEncoding) {
postEncode();
@@ -267,6 +273,9 @@ public class HTTPArtifactEncoder extends BaseSAML2MessageEncoder implements HTML
}
final HttpServletResponse response = getHttpServletResponse();
+ if (response == null) {
+ throw new MessageEncodingException("HttpServletResponse was null");
+ }
context.put("response", response);
try {
@@ -321,6 +330,9 @@ public class HTTPArtifactEncoder extends BaseSAML2MessageEncoder implements HTML
}
final HttpServletResponse response = getHttpServletResponse();
+ if (response == null) {
+ throw new MessageEncodingException("HttpServletResponse was null");
+ }
try {
response.sendRedirect(urlBuilder.buildURL());
} catch (final IOException e) {
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilterTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilterTest.java
index 62e07dbe7..0144f24ff 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilterTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilterTest.java
@@ -138,6 +138,7 @@ public class AlgorithmFilterTest extends XMLObjectBaseTestCase implements Predic
for (final RoleDescriptor role : entity.getRoleDescriptors()) {
exts = role.getExtensions();
+ assert exts != null;
Assert.assertEquals(exts.getUnknownXMLObjects(DigestMethod.DEFAULT_ELEMENT_NAME).size(), 1);
Assert.assertEquals(exts.getUnknownXMLObjects(SigningMethod.DEFAULT_ELEMENT_NAME).size(), 1);
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPRedirectDeflateDecoderTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPRedirectDeflateDecoderTest.java
index f67dce9bc..bcb1bdcd4 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPRedirectDeflateDecoderTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPRedirectDeflateDecoderTest.java
@@ -155,6 +155,7 @@ public class HTTPRedirectDeflateDecoderTest extends XMLObjectBaseTestCase {
new Pair<>("Signature", httpRequest.getParameter("Signature")),
new Pair<>("RelayState", httpRequest.getParameter("RelayState"))
));
+ assert query != null;
httpRequest.setQueryString(query);
decoder.decode();
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPRedirectDeflateSignatureSecurityHandlerTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPRedirectDeflateSignatureSecurityHandlerTest.java
index 6cd2df936..17a8bf7bf 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPRedirectDeflateSignatureSecurityHandlerTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPRedirectDeflateSignatureSecurityHandlerTest.java
@@ -379,7 +379,9 @@ public class SAML2HTTPRedirectDeflateSignatureSecurityHandlerTest extends XMLObj
Assert.fail("Could not parse redirect url: " + response.getRedirectedUrl());
}
assert urlBuilder != null;
- request.setQueryString(urlBuilder.buildQueryString());
+ final String query = urlBuilder.buildQueryString();
+ assert query != null;
+ request.setQueryString(query);
for (final Pair<String, String> param : urlBuilder.getQueryParams()) {
final String one = param.getFirst();
final String two = param.getSecond();
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list