Martin Choma created WFLY-8095: ---------------------------------- Summary: Coverity static analysis, Dereference null return value, OAuth2CredentialSource (Elytron) Key: WFLY-8095 URL: https://issues.jboss.org/browse/WFLY-8095 Project: WildFly Issue Type: Bug Components: Security Reporter: Martin Choma Assignee: Darran Lofthouse Priority: Critical Coverity found possible dereferencing of null value returned from {{resolveSSLContext()}} in {{openConnection()}} https://scan7.coverity.com/reports.htm#v23632/p11778/fileInstanceId=95640... {code:java|title=OAuth2CredentialSource.java} private SSLContext resolveSSLContext() { if (!isHttps(tokenEndpointUri)) { return null; } return sslContextSupplier == null ? null : sslContextSupplier.get(); } private HttpURLConnection openConnection() throws IOException { log.debugf("Opening connection to [%s]", tokenEndpointUri); HttpURLConnection connection = (HttpURLConnection) tokenEndpointUri.openConnection(); if (isHttps(tokenEndpointUri)) { HttpsURLConnection https = (HttpsURLConnection) connection; https.setSSLSocketFactory(resolveSSLContext().getSocketFactory()); if (hostnameVerifierSupplier != null) { https.setHostnameVerifier(checkNotNullParam("hostnameVerifier", hostnameVerifierSupplier.get())); } } return connection; } {code} NPE could probably happen if {{oauth2-introspection}} is configured with no {{client-ssl-context}} and https {{introspection-url}}. -- This message was sent by Atlassian JIRA (v7.2.3#72005)