You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ws.apache.org by co...@apache.org on 2026/09/04 06:41:29 UTC
(ws-wss4j) 01/01: Fix a potential NPE with HSM based Crypto instances in the derived key parser
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch coheigea/dkt-npe
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
commit cca9ef27c83d329de2e7251f63bc4a0b72f57bd9
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Fri Sep 4 07:40:56 2026 +0100
Fix a potential NPE with HSM based Crypto instances in the derived key parser
---
.../java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java b/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java
index 2893a8785..fe6b34dca 100644
--- a/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java
+++ b/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java
@@ -189,7 +189,14 @@ public class DerivedKeyTokenSTRParser implements STRParser {
}
parserResult.setSecretKey(secretKey);
} else {
- byte[] secretKey = crypto.getPrivateKey(certs[0], data.getCallbackHandler()).getEncoded();
+ java.security.PrivateKey privateKey = crypto.getPrivateKey(certs[0], data.getCallbackHandler());
+ // HSM-backed keys are often non-extractable and return a null encoding
+ byte[] secretKey = privateKey == null ? null : privateKey.getEncoded();
+ if (secretKey == null || secretKey.length == 0) {
+ throw new WSSecurityException(
+ WSSecurityException.ErrorCode.FAILED_CHECK, "unsupportedKeyId",
+ new Object[] {uri});
+ }
parserResult.setSecretKey(secretKey);
}
}