You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ws.apache.org by co...@apache.org on 2026/09/04 06:59:02 UTC
(ws-wss4j) branch 2_4_x-fixes updated: Fix a potential NPE with HSM based Crypto instances in the derived key parser (#670)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 2_4_x-fixes
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
The following commit(s) were added to refs/heads/2_4_x-fixes by this push:
new b75d17e76 Fix a potential NPE with HSM based Crypto instances in the derived key parser (#670)
b75d17e76 is described below
commit b75d17e76fd977abb428b12dc40058af4fb42ec0
Author: Colm O hEigeartaigh <co...@users.noreply.github.com>
AuthorDate: Fri Sep 4 07:56:35 2026 +0100
Fix a potential NPE with HSM based Crypto instances in the derived key parser (#670)
---
.../java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java b/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java
index 52e6dc297..a17a80431 100644
--- a/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java
+++ b/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java
@@ -190,7 +190,14 @@ public class DerivedKeyTokenSTRParser implements STRParser {
}
parserResult.setSecretKey(secretKey);
} else {
- byte[] secretKey = crypto.getPrivateKey(certs[0], data.getCallbackHandler()).getEncoded();
+ java.security.PrivateKey privateKey = crypto.getPrivateKey(certs[0], data.getCallbackHandler());
+ // HSM-backed keys are often non-extractable and return a null encoding
+ byte[] secretKey = privateKey == null ? null : privateKey.getEncoded();
+ if (secretKey == null || secretKey.length == 0) {
+ throw new WSSecurityException(
+ WSSecurityException.ErrorCode.FAILED_CHECK, "unsupportedKeyId",
+ new Object[] {uri});
+ }
parserResult.setSecretKey(secretKey);
}
}