-
Bug
-
Resolution: Done
-
Critical
-
7.1.0.DR12
Coverity found possible dereferencing of null value returned from resolveSSLContext() in openConnection()
OAuth2CredentialSource.java
private SSLContext resolveSSLContext() { if (!isHttps(tokenEndpointUri)) { return null; } return sslContextSupplier == null ? null : sslContextSupplier.get(); } private HttpURLConnection openConnection() throws IOException { log.debugf("Opening connection to [%s]", tokenEndpointUri); HttpURLConnection connection = (HttpURLConnection) tokenEndpointUri.openConnection(); if (isHttps(tokenEndpointUri)) { HttpsURLConnection https = (HttpsURLConnection) connection; https.setSSLSocketFactory(resolveSSLContext().getSocketFactory()); if (hostnameVerifierSupplier != null) { https.setHostnameVerifier(checkNotNullParam("hostnameVerifier", hostnameVerifierSupplier.get())); } } return connection; }
NPE could probably happen if oauth2-introspection is configured with no client-ssl-context and https introspection-url.
- is cloned by
-
ELY-954 Coverity static analysis, Dereference null return value, OAuth2CredentialSource (Elytron)
- Resolved