[jboss-jira] [JBoss JIRA] (WFLY-8103) Coverity static analysis, Dereference after null check, KeyStoreService (elytron-subsystem)

[Darran Lofthouse (JIRA)]

     [ https://issues.jboss.org/browse/WFLY-8103?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Darran Lofthouse updated WFLY-8103:
-----------------------------------
    Fix Version/s: 11.0.0.Alpha1


> Coverity static analysis, Dereference after null check, KeyStoreService (elytron-subsystem) 
> --------------------------------------------------------------------------------------------
>
>                 Key: WFLY-8103
>                 URL: https://issues.jboss.org/browse/WFLY-8103
>             Project: WildFly
>          Issue Type: Bug
>          Components: Security
>            Reporter: Martin Choma
>            Assignee: Ilia Vassilev
>             Fix For: 11.0.0.Alpha1
>
>
> Coverity found 2 occurences of possible null dereference.
> https://scan7.coverity.com/reports.htm#v23632/p12663/fileInstanceId=9564434&defectInstanceId=2359322&mergedDefectId=1395584
> https://scan7.coverity.com/reports.htm#v23632/p12663/fileInstanceId=9564434&defectInstanceId=2359323&mergedDefectId=1395585
> Method {{resolvePassword()}} is dereferencing {{resolvedPath}} field
> {code}
>     private char[] resolvePassword() throws Exception {
>         ExceptionSupplier<CredentialSource, Exception> sourceSupplier = credentialSourceSupplier.getValue();
>         CredentialSource cs = sourceSupplier != null ? sourceSupplier.get() : null;
>         if (cs != null) {
>             return cs.getCredential(PasswordCredential.class).getPassword(ClearPassword.class).getPassword();
>         } else {
>             throw ROOT_LOGGER.keyStorePasswordCannotBeResolved(resolvedPath.getPath());
>         }
>     }
> {code}
> And method {{resolvePassword()}} is called 2 times from block, where resolvedPath is checked on null
> {code}
>     try (InputStream is = resolvedPath != null ? new FileInputStream(resolvedPath) : null) {
>         AtomicLoadKeyStore.LoadKey loadKey = keyStore.revertibleLoad(is, resolvePassword());
>     try (InputStream is = resolvedPath != null ? new FileInputStream(resolvedPath) : null) {
>         char[] password = resolvePassword();
> {code}
> Add null check into {{resolvePassword()}} method.



--
This message was sent by Atlassian JIRA
(v7.2.3#72005)