You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ws.apache.org by co...@apache.org on 2026/09/04 06:41:28 UTC
(ws-wss4j) branch coheigea/dkt-npe created (now cca9ef27c)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a change to branch coheigea/dkt-npe
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
at cca9ef27c Fix a potential NPE with HSM based Crypto instances in the derived key parser
This branch includes the following new commits:
new cca9ef27c Fix a potential NPE with HSM based Crypto instances in the derived key parser
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(ws-wss4j) 01/01: Fix a potential NPE with HSM based Crypto instances in the derived key parser
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch coheigea/dkt-npe
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
commit cca9ef27c83d329de2e7251f63bc4a0b72f57bd9
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Fri Sep 4 07:40:56 2026 +0100
Fix a potential NPE with HSM based Crypto instances in the derived key parser
---
.../java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java b/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java
index 2893a8785..fe6b34dca 100644
--- a/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java
+++ b/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java
@@ -189,7 +189,14 @@ public class DerivedKeyTokenSTRParser implements STRParser {
}
parserResult.setSecretKey(secretKey);
} else {
- byte[] secretKey = crypto.getPrivateKey(certs[0], data.getCallbackHandler()).getEncoded();
+ java.security.PrivateKey privateKey = crypto.getPrivateKey(certs[0], data.getCallbackHandler());
+ // HSM-backed keys are often non-extractable and return a null encoding
+ byte[] secretKey = privateKey == null ? null : privateKey.getEncoded();
+ if (secretKey == null || secretKey.length == 0) {
+ throw new WSSecurityException(
+ WSSecurityException.ErrorCode.FAILED_CHECK, "unsupportedKeyId",
+ new Object[] {uri});
+ }
parserResult.setSecretKey(secretKey);
}
}