[JBoss JIRA] (ELY-954) Coverity static analysis, Dereference null return value, OAuth2CredentialSource (Elytron)
by Ilia Vassilev (JIRA)
[ https://issues.jboss.org/browse/ELY-954?page=com.atlassian.jira.plugin.sy... ]
Ilia Vassilev moved WFLY-8095 to ELY-954:
-----------------------------------------
Project: WildFly Elytron (was: WildFly)
Key: ELY-954 (was: WFLY-8095)
Component/s: Credential Store
(was: Security)
> Coverity static analysis, Dereference null return value, OAuth2CredentialSource (Elytron)
> -----------------------------------------------------------------------------------------
>
> Key: ELY-954
> URL: https://issues.jboss.org/browse/ELY-954
> Project: WildFly Elytron
> Issue Type: Bug
> Components: Credential Store
> Reporter: Martin Choma
> Assignee: Darran Lofthouse
> Priority: Critical
>
> Coverity found possible dereferencing of null value returned from {{resolveSSLContext()}} in {{openConnection()}}
> https://scan7.coverity.com/reports.htm#v23632/p11778/fileInstanceId=95640...
> {code:java|title=OAuth2CredentialSource.java}
> private SSLContext resolveSSLContext() {
> if (!isHttps(tokenEndpointUri)) {
> return null;
> }
> return sslContextSupplier == null ? null : sslContextSupplier.get();
> }
> private HttpURLConnection openConnection() throws IOException {
> log.debugf("Opening connection to [%s]", tokenEndpointUri);
> HttpURLConnection connection = (HttpURLConnection) tokenEndpointUri.openConnection();
> if (isHttps(tokenEndpointUri)) {
> HttpsURLConnection https = (HttpsURLConnection) connection;
> https.setSSLSocketFactory(resolveSSLContext().getSocketFactory());
> if (hostnameVerifierSupplier != null) {
> https.setHostnameVerifier(checkNotNullParam("hostnameVerifier", hostnameVerifierSupplier.get()));
> }
> }
> return connection;
> }
> {code}
> NPE could probably happen if {{oauth2-introspection}} is configured with no {{client-ssl-context}} and https {{introspection-url}}.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months
[JBoss JIRA] (ELY-954) Coverity static analysis, Dereference null return value, OAuth2CredentialSource (Elytron)
by Ilia Vassilev (JIRA)
[ https://issues.jboss.org/browse/ELY-954?page=com.atlassian.jira.plugin.sy... ]
Ilia Vassilev reassigned ELY-954:
---------------------------------
Assignee: Ilia Vassilev (was: Darran Lofthouse)
> Coverity static analysis, Dereference null return value, OAuth2CredentialSource (Elytron)
> -----------------------------------------------------------------------------------------
>
> Key: ELY-954
> URL: https://issues.jboss.org/browse/ELY-954
> Project: WildFly Elytron
> Issue Type: Bug
> Components: Credential Store
> Reporter: Martin Choma
> Assignee: Ilia Vassilev
> Priority: Critical
>
> Coverity found possible dereferencing of null value returned from {{resolveSSLContext()}} in {{openConnection()}}
> https://scan7.coverity.com/reports.htm#v23632/p11778/fileInstanceId=95640...
> {code:java|title=OAuth2CredentialSource.java}
> private SSLContext resolveSSLContext() {
> if (!isHttps(tokenEndpointUri)) {
> return null;
> }
> return sslContextSupplier == null ? null : sslContextSupplier.get();
> }
> private HttpURLConnection openConnection() throws IOException {
> log.debugf("Opening connection to [%s]", tokenEndpointUri);
> HttpURLConnection connection = (HttpURLConnection) tokenEndpointUri.openConnection();
> if (isHttps(tokenEndpointUri)) {
> HttpsURLConnection https = (HttpsURLConnection) connection;
> https.setSSLSocketFactory(resolveSSLContext().getSocketFactory());
> if (hostnameVerifierSupplier != null) {
> https.setHostnameVerifier(checkNotNullParam("hostnameVerifier", hostnameVerifierSupplier.get()));
> }
> }
> return connection;
> }
> {code}
> NPE could probably happen if {{oauth2-introspection}} is configured with no {{client-ssl-context}} and https {{introspection-url}}.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months
[JBoss JIRA] (ELY-951) Event handling queues
by Darran Lofthouse (JIRA)
Darran Lofthouse created ELY-951:
------------------------------------
Summary: Event handling queues
Key: ELY-951
URL: https://issues.jboss.org/browse/ELY-951
Project: WildFly Elytron
Issue Type: Task
Components: Audit
Reporter: Darran Lofthouse
Assignee: Darran Lofthouse
Fix For: 1.1.0.Beta25
Currently audit events are handled synchronously which may be desirable to ensure events are logged.
However this does risk performance so queuing of events may also be desirable.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months
[JBoss JIRA] (ELY-950) Add local audit log rotation
by Darran Lofthouse (JIRA)
Darran Lofthouse created ELY-950:
------------------------------------
Summary: Add local audit log rotation
Key: ELY-950
URL: https://issues.jboss.org/browse/ELY-950
Project: WildFly Elytron
Issue Type: Task
Components: Audit
Reporter: Darran Lofthouse
Assignee: Darran Lofthouse
Fix For: 1.1.0.Beta25
Could be by time, size, rotate on start-up or a combination.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months
[JBoss JIRA] (ELY-949) Add a mechanism to assign priorities to audit events
by Darran Lofthouse (JIRA)
Darran Lofthouse created ELY-949:
------------------------------------
Summary: Add a mechanism to assign priorities to audit events
Key: ELY-949
URL: https://issues.jboss.org/browse/ELY-949
Project: WildFly Elytron
Issue Type: Task
Components: Audit
Reporter: Darran Lofthouse
Assignee: Darran Lofthouse
Fix For: 1.1.0.Beta25
We probably want something like MatchRule but also need to think about how it will be configured.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
9 years, 2 months