November 2016 - jboss-jira - Jboss List Archives

[JBoss JIRA] (ELY-744) Create log categories for mechanisms instead of prefixing messages

by Jan Kalina (JIRA)

Jan Kalina created ELY-744: ------------------------------ Summary: Create log categories for mechanisms instead of prefixing messages Key: ELY-744 URL: https://issues.jboss.org/browse/ELY-744 Project: WildFly Elytron Issue Type: Enhancement Reporter: Jan Kalina Assignee: Jan Kalina Priority: Minor In log messages are often used prefixes to determine context of the message - typically name of mechanism: {code:java} log.trace("ClientCertAuthenticationMechanism: re-authentication succeed"); {code} This should be replaced by standalone log categories. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-621) Client Cert authentication trigger SSLSession renegotiation?

by David Lloyd (JIRA)

[ https://issues.jboss.org/browse/ELY-621?page=com.atlassian.jira.plugin.sy... ] David Lloyd commented on ELY-621: --------------------------------- Bear in mind that session renegotiation will likely be completely gone in TLS 1.3. > Client Cert authentication trigger SSLSession renegotiation? > ------------------------------------------------------------ > > Key: ELY-621 > URL: https://issues.jboss.org/browse/ELY-621 > Project: WildFly Elytron > Issue Type: Feature Request > Components: HTTP > Reporter: Darran Lofthouse > Assignee: Darran Lofthouse > Fix For: 1.1.0.Beta14 > > > This could be an option to enable demanding client verification for an established connection but depending on the application being accessed. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-743) Coverity static analysis: Dereference null return value in ServerAuthenticationContext (Elytron)

by Josef Cacek (JIRA)

Josef Cacek created ELY-743: ------------------------------- Summary: Coverity static analysis: Dereference null return value in ServerAuthenticationContext (Elytron) Key: ELY-743 URL: https://issues.jboss.org/browse/ELY-743 Project: WildFly Elytron Issue Type: Bug Reporter: Josef Cacek Assignee: Darran Lofthouse Coverity static-analysis scan found 3 possible calls on null objects in {{ServerAuthenticationContext}} class. https://scan7.coverity.com/reports.htm#v16159/p11778/fileInstanceId=57603... In {{ServerAuthenticationContext.AuthorizedState.isSamePrincipal(Principal)}} - Return value of function which returns null is dereferenced without checking. {code} 2039 boolean isSamePrincipal(final Principal principal) { // 1. returned_null: getName returns null (checked 9 out of 11 times). (The virtual call resolves to org.wildfly.security.auth.server.PrincipalDecoder.<clinit>/<gen>org.wildfly.security.auth.server.PrincipalDecoder_instance_2.getName.) [show details] // 2. var_assigned: Assigning: name = null return value from getName. 2040 String name = authorizedIdentity.getSecurityDomain().getPrincipalDecoder().getName(principal); // CID 1369286 (#1 of 1): Dereference null return value (NULL_RETURNS)3. dereference: Dereferencing a pointer that might be null name when calling isSameName. [show details] 2041 return isSameName(name); 2042 } {code} https://scan7.coverity.com/reports.htm#v16159/p11778/fileInstanceId=57603... In {{ServerAuthenticationContext.NameAssignedState.isSamePrincipal(Principal)}} - the same as the previous one. https://scan7.coverity.com/reports.htm#v16159/p11778/fileInstanceId=57603... In {{ServerAuthenticationContext.ANONYMOUS.handleOne(Callback[], int)}} {code} 790 final PasswordCallback passwordCallback = (PasswordCallback) callback; 791 // 8. returned_null: getCredentialAcquireSupport returns null (checked 0 out of 1 times). [show details] // CID 1369304 (#1 of 1): Dereference null return value (NULL_RETURNS)9. null_method_call: Calling a method on null object getCredentialAcquireSupport(org.wildfly.security.credential.PasswordCredential.class). 792 if (getCredentialAcquireSupport(PasswordCredential.class).mayBeSupported()) { {code} *Suggested improvement* Add null checks. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-742) SASL client mechs should use javax.security.sasl.AuthenticationException where appropriate

by David Lloyd (JIRA)

David Lloyd created ELY-742: ------------------------------- Summary: SASL client mechs should use javax.security.sasl.AuthenticationException where appropriate Key: ELY-742 URL: https://issues.jboss.org/browse/ELY-742 Project: WildFly Elytron Issue Type: Task Components: Authentication Mechanisms, SASL Reporter: David Lloyd Priority: Minor There is a specific exception type which indicates that a SASL authentication has failed as opposed to a protocol/transit or operational problem. We should use that whenever appropriate. This means we'd need to add a {{toSaslAuthenticationException()}} method to {{org.wildfly.security.mechanism.AuthenticationMechanismException}}. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFLY-7562) statistics-enabled attribute of webservices subsystem could allow expressions

by Tomas Hofman (JIRA)

[ https://issues.jboss.org/browse/WFLY-7562?page=com.atlassian.jira.plugin.... ] Tomas Hofman updated WFLY-7562: ------------------------------- Affects Version/s: 10.1.0.Final > statistics-enabled attribute of webservices subsystem could allow expressions > ----------------------------------------------------------------------------- > > Key: WFLY-7562 > URL: https://issues.jboss.org/browse/WFLY-7562 > Project: WildFly > Issue Type: Enhancement > Components: Web Services > Affects Versions: 10.1.0.Final > Reporter: Tomas Hofman > Assignee: Tomas Hofman > Priority: Minor > > As suggested by Brian in JBEAP-6651, there is no reason for 'statistics-enabled' attribute disallowing expressions as its value. From quick look to other subsystems, they allow expressions for corresponding attribute. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-741) Coverity static analysis: Dereference null return value in SSLConfiguratorImpl (Elytron)

by Josef Cacek (JIRA)

Josef Cacek created ELY-741: ------------------------------- Summary: Coverity static analysis: Dereference null return value in SSLConfiguratorImpl (Elytron) Key: ELY-741 URL: https://issues.jboss.org/browse/ELY-741 Project: WildFly Elytron Issue Type: Bug Reporter: Josef Cacek Assignee: Darran Lofthouse Coverity static-analysis scan found 2 possible calls on null objects in {{SSLConfiguratorImpl.getDefaultSSLParameters()}} method. Both calls are related to following line: {code} configure(original, supportedSSLParameters.getProtocols(), supportedSSLParameters.getCipherSuites()); {code} https://scan7.coverity.com/reports.htm#v16159/p11778/fileInstanceId=57598... The {{getCipherSuites()}} call can return null ({{javax.net.ssl.SSLParameters.getCipherSuites}}) which can propagate to {{CipherSuiteSelector.evaluate()}} call where {{supportedMechanisms.length}} is used without null check. https://scan7.coverity.com/reports.htm#v16159/p11778/fileInstanceId=57598... The {{getProtocols()}} call can return null ({{javax.net.ssl.SSLParameters.getProtocols}}) which can propagate to {{ProtocolSelector.evaluate()}} call where {{supportedProtocols}} is used in for loop without null check. *Suggested improvement* Add null checks. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFLY-7562) statistics-enabled attribute of webservices subsystem could allow expressions

by Tomas Hofman (JIRA)

[ https://issues.jboss.org/browse/WFLY-7562?page=com.atlassian.jira.plugin.... ] Tomas Hofman moved JBEAP-7079 to WFLY-7562: ------------------------------------------- Project: WildFly (was: JBoss Enterprise Application Platform) Key: WFLY-7562 (was: JBEAP-7079) Workflow: GIT Pull Request workflow (was: CDW with loose statuses v1) Component/s: Web Services (was: Web Services) Affects Version/s: (was: 7.1.0.DR7) > statistics-enabled attribute of webservices subsystem could allow expressions > ----------------------------------------------------------------------------- > > Key: WFLY-7562 > URL: https://issues.jboss.org/browse/WFLY-7562 > Project: WildFly > Issue Type: Enhancement > Components: Web Services > Reporter: Tomas Hofman > Assignee: Tomas Hofman > Priority: Minor > > As suggested by Brian in JBEAP-6651, there is no reason for 'statistics-enabled' attribute disallowing expressions as its value. From quick look to other subsystems, they allow expressions for corresponding attribute. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-738) Coverity static analysis: Dereference null return value in SingleSignOnServerMechanismFactory (Elytron)

by Ilia Vassilev (JIRA)

[ https://issues.jboss.org/browse/ELY-738?page=com.atlassian.jira.plugin.sy... ] Ilia Vassilev reassigned ELY-738: --------------------------------- Assignee: Ilia Vassilev (was: Darran Lofthouse) > Coverity static analysis: Dereference null return value in SingleSignOnServerMechanismFactory (Elytron) > ------------------------------------------------------------------------------------------------------- > > Key: ELY-738 > URL: https://issues.jboss.org/browse/ELY-738 > Project: WildFly Elytron > Issue Type: Bug > Reporter: Josef Cacek > Assignee: Ilia Vassilev > Labels: static_analysis > > Coverity static-analysis scan found possible call on null object in {{SingleSignOnServerMechanismFactory.evaluateRequst()}} method: > {code} > getTargetMechanism(mechanismName, singleSignOnSession).evaluateRequest(createHttpServerRequest(request, singleSignOnSession)); > {code} > https://scan7.coverity.com/reports.htm#v16159/p11778/fileInstanceId=57602... > The problem is the {{getTargetMechanism}} call, which just calls an {{HttpServerAuthenticationMechanismFactory.createAuthenticationMechanism()}} method. > The {{createAuthenticationMechanism}} doesn't declare it could return null, nevertheless, the implementations use null as fallback (e.g. look at {{ServerMechanismFactoryImpl.createAuthenticationMechanism()}}) > *Suggested improvement* > I see 2 possible solutions: > 1. Declare in javadoc of {{HttpServerAuthenticationMechanismFactory.createAuthenticationMechanism()}} method, that it can return null and add the null-check into the {{SingleSignOnServerMechanismFactory.evaluateRequst()}} method > 2. or throw an exception from {{HttpServerAuthenticationMechanismFactory.createAuthenticationMechanism()}} implementations instead of returning null -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-740) Coverity static analysis: Dereference null return value in EntityUtil (Elytron)

by Ilia Vassilev (JIRA)

[ https://issues.jboss.org/browse/ELY-740?page=com.atlassian.jira.plugin.sy... ] Ilia Vassilev reassigned ELY-740: --------------------------------- Assignee: Ilia Vassilev (was: Darran Lofthouse) > Coverity static analysis: Dereference null return value in EntityUtil (Elytron) > ------------------------------------------------------------------------------- > > Key: ELY-740 > URL: https://issues.jboss.org/browse/ELY-740 > Project: WildFly Elytron > Issue Type: Bug > Reporter: Josef Cacek > Assignee: Ilia Vassilev > Labels: static_analysis > > Coverity static-analysis scan found possible call on null object in {{EntityUtil.encodeAlgorithmIdentifier}} method: > https://scan7.coverity.com/reports.htm#v16159/p11778/fileInstanceId=57603... > In the call > {{encodeAlgorithmIdentifier(encoder, algorithmOid(algorithm), omitParametersField);}} > the {{algorithmOid()}} may return null (look at {{Entity}} class). > Then the {{encodeAlgorithmIdentifier}} calls {{DerEncoder.encodeObjectIdentifier}} where on the given String is called {{length()}} method without a null check. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

[JBoss JIRA] (ELY-740) Coverity static analysis: Dereference null return value in EntityUtil (Elytron)

by Josef Cacek (JIRA)

Josef Cacek created ELY-740: ------------------------------- Summary: Coverity static analysis: Dereference null return value in EntityUtil (Elytron) Key: ELY-740 URL: https://issues.jboss.org/browse/ELY-740 Project: WildFly Elytron Issue Type: Bug Reporter: Josef Cacek Assignee: Darran Lofthouse Coverity static-analysis scan found possible call on null object in {{EntityUtil.encodeAlgorithmIdentifier}} method: https://scan7.coverity.com/reports.htm#v16159/p11778/fileInstanceId=57603... In the call {{encodeAlgorithmIdentifier(encoder, algorithmOid(algorithm), omitParametersField);}} the {{algorithmOid()}} may return null (look at {{Entity}} class). Then the {{encodeAlgorithmIdentifier}} calls {{DerEncoder.encodeObjectIdentifier}} where on the given String is called {{length()}} method without a null check. -- This message was sent by Atlassian JIRA (v7.2.3#72005)

9 years, 8 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira November 2016