Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-8796

Coverity static analysis, Dereference null return value, OAuth2CredentialSource (Elytron)

XMLWordPrintable

      Coverity found possible dereferencing of null value returned from resolveSSLContext() in openConnection()

      https://scan7.coverity.com/reports.htm#v23632/p11778/fileInstanceId=9564099&defectInstanceId=2359300&mergedDefectId=1389514

      OAuth2CredentialSource.java
          private SSLContext resolveSSLContext() {
              if (!isHttps(tokenEndpointUri)) {
                  return null;
              }
              return sslContextSupplier == null ? null : sslContextSupplier.get();
          }
      
          private HttpURLConnection openConnection() throws IOException {
              log.debugf("Opening connection to [%s]", tokenEndpointUri);
              HttpURLConnection connection = (HttpURLConnection) tokenEndpointUri.openConnection();
      
              if (isHttps(tokenEndpointUri)) {
                  HttpsURLConnection https = (HttpsURLConnection) connection;
      
                  https.setSSLSocketFactory(resolveSSLContext().getSocketFactory());
                  if (hostnameVerifierSupplier != null) {
                      https.setHostnameVerifier(checkNotNullParam("hostnameVerifier", hostnameVerifierSupplier.get()));
                  }
              }
      
              return connection;
          }
      

      NPE could probably happen if oauth2-introspection is configured with no client-ssl-context and https introspection-url.

              rhn-support-ivassile Ilia Vassilev
              mchoma@redhat.com Martin Choma
              Martin Choma Martin Choma
              Martin Choma Martin Choma
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: