[jboss-jira] [JBoss JIRA] (ELY-1235) Coverity, Dereference null return value, JdbcSecurityRealm (Elytron)

[Ilia Vassilev (JIRA)]

     [ https://issues.jboss.org/browse/ELY-1235?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Ilia Vassilev reassigned ELY-1235:
----------------------------------

    Assignee: Ilia Vassilev  (was: Darran Lofthouse)


> Coverity, Dereference null return value, JdbcSecurityRealm (Elytron)
> --------------------------------------------------------------------
>
>                 Key: ELY-1235
>                 URL: https://issues.jboss.org/browse/ELY-1235
>             Project: WildFly Elytron
>          Issue Type: Bug
>            Reporter: Martin Choma
>            Assignee: Ilia Vassilev
>            Priority: Critical
>
> Coverity found possible dereference of null.
> executePrincipalQuery() can return {{null}} and {{credential.matches()}} is called without check
> {code:java|title=JdbcSecurityRealm.java}
>      @Override
> 156        public <C extends Credential> C getCredential(final Class<C> credentialType, final String algorithmName, final AlgorithmParameterSpec parameterSpec) throws RealmUnavailableException {
> 157            Assert.checkNotNullParam("credentialType", credentialType);
> 158            for (QueryConfiguration configuration : JdbcSecurityRealm.this.queryConfiguration) {
> 159                for (KeyMapper keyMapper : configuration.getColumnMappers(KeyMapper.class)) {
> 160                    if (keyMapper.getCredentialAcquireSupport(credentialType, algorithmName, parameterSpec).mayBeSupported()) {
> 161                        final Credential credential = executePrincipalQuery(configuration, r -> keyMapper.map(r, providers));
> 162                        if (credential.matches(credentialType, algorithmName, parameterSpec)) {
> 163                            return credentialType.cast(credential);
> 164                        }
> 165                    }
> 166                }
> 167            }
> 168
> 169            return null;
> 170        }
> {code}
> https://scan7.coverity.com/reports.htm#v23632/p11778/fileInstanceId=22329013&defectInstanceId=5071812&mergedDefectId=1440468



--
This message was sent by Atlassian JIRA
(v7.2.3#72005)