Coverity static analysis: Explicit null dereferenced in NonceManager (Elytron) ------------------------------------------------------------------------------ Key: ELY-750 URL: https://issues.jboss.org/browse/ELY-750 Project: WildFly Elytron Issue Type: Bug Reporter: Josef Cacek Assignee: Ilia Vassilev Priority: Critical Labels: static_analysis Fix For: 1.1.0.Beta15 Coverity static-analysis scan found 2 usages of null object in {{NonceManager}} class. https://scan7.coverity.com/reports.htm#v16159/p11778/fileInstanceId=57602... The method {{generateNonce()}} without params, call {{generateNonce(null)}} - where {{null}} is provided as a ({{byte[] salt}}) It's used later in the code: {code} if (log.isTraceEnabled()) { log.tracef("New nonce generated %s, using seed %s", nonce, new String(salt, StandardCharsets.UTF_8)); } {code} so it will throw NPE when trace-logging is enabled. https://scan7.coverity.com/reports.htm#v16159/p11778/fileInstanceId=57602... similar problem in {{useNonce(nonce)}} calling {{useNonce(nonce, null)}}