You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@syncope.apache.org by il...@apache.org on 2020/10/22 10:21:08 UTC

[syncope] branch master updated: Fixing some more CodeQL notes

This is an automated email from the ASF dual-hosted git repository.

ilgrosso pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/syncope.git


The following commit(s) were added to refs/heads/master by this push:
     new 11a17dc  Fixing some more CodeQL notes
11a17dc is described below

commit 11a17dc7330d98401b74a1ad5de2970694b399ef
Author: Francesco Chicchiriccò <il...@apache.org>
AuthorDate: Thu Oct 22 12:20:53 2020 +0200

    Fixing some more CodeQL notes
---
 .../markup/html/form/AbstractMultiPanel.java       |  7 +--
 .../markup/html/form/AjaxSpinnerFieldPanel.java    |  4 +-
 .../commons/markup/html/form/DateFieldPanel.java   |  2 +-
 .../client/console/SyncopeWebApplication.java      | 16 +++++-
 .../syncope/client/console/batch/BatchContent.java |  6 +--
 .../syncope/client/console/batch/BatchModal.java   |  4 +-
 .../client/console/panels/AjaxDataTablePanel.java  |  1 -
 .../client/console/panels/FailureMessageModal.java | 43 ---------------
 .../panels/ImplementationEngineTogglePanel.java    |  1 -
 .../console/wizards/any/AnyWizardBuilder.java      |  2 +-
 .../client/console/wizards/any/PlainAttrs.java     |  2 -
 .../client/enduser/SyncopeWebApplication.java      | 63 ++++++++++++++++++----
 .../client/enduser/wizards/any/AbstractAttrs.java  |  9 ++--
 .../enduser/wizards/any/AnyWizardBuilder.java      |  2 -
 .../client/enduser/wizards/any/PlainAttrs.java     |  6 +--
 .../client/enduser/wizards/any/UserDetails.java    |  1 -
 .../apache/syncope/common/lib/AnyOperations.java   |  2 +-
 .../common/lib/search/SyncopeFiqlParser.java       |  3 +-
 .../jpa/entity/auth/AbstractClientApp.java         |  2 +
 .../core/persistence/jpa/entity/auth/JPACASSP.java |  5 +-
 .../jpa/openjpa/LocaleValueHandler.java            | 13 ++---
 .../java/data/AbstractAnyDataBinder.java           |  3 +-
 .../java/data/AnyObjectDataBinderImpl.java         |  3 +-
 .../java/data/GroupDataBinderImpl.java             |  3 +-
 .../provisioning/java/data/UserDataBinderImpl.java |  3 +-
 .../fit/core/AbstractNotificationTaskITCase.java   |  2 +-
 .../java/org/apache/syncope/sra/RouteProvider.java | 28 ++++++++--
 27 files changed, 126 insertions(+), 110 deletions(-)

diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AbstractMultiPanel.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AbstractMultiPanel.java
index 3079bf6..3a86f00 100644
--- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AbstractMultiPanel.java
+++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AbstractMultiPanel.java
@@ -81,7 +81,7 @@ public abstract class AbstractMultiPanel<INNER> extends AbstractFieldPanel<List<
     private Fragment getNoDataFragment(final IModel<List<INNER>> model, final String label) {
         final Fragment fragment = new Fragment("content", "noDataFragment", AbstractMultiPanel.this);
         fragment.add(new Label("field-label", new ResourceModel(label, label)));
-        fragment.add(getPlusFragment(model, label));
+        fragment.add(getPlusFragment(model));
         return fragment;
     }
 
@@ -91,7 +91,7 @@ public abstract class AbstractMultiPanel<INNER> extends AbstractFieldPanel<List<
         return contentFragment;
     }
 
-    private Fragment getPlusFragment(final IModel<List<INNER>> model, final String label) {
+    private Fragment getPlusFragment(final IModel<List<INNER>> model) {
         final IndicatorAjaxSubmitLink plus = new IndicatorAjaxSubmitLink("add") {
 
             private static final long serialVersionUID = -7978723352517770644L;
@@ -186,7 +186,7 @@ public abstract class AbstractMultiPanel<INNER> extends AbstractFieldPanel<List<
 
             final Fragment fragment;
             if (item.getIndex() == model.getObject().size() - 1) {
-                fragment = getPlusFragment(model, label);
+                fragment = getPlusFragment(model);
             } else {
                 fragment = new Fragment("panelPlus", "emptyFragment", AbstractMultiPanel.this);
             }
@@ -201,6 +201,7 @@ public abstract class AbstractMultiPanel<INNER> extends AbstractFieldPanel<List<
         // do nothing by default
     }
 
+    @Override
     public AbstractFieldPanel<List<INNER>> setReadOnly(final boolean readOnly) {
         container.setEnabled(!readOnly);
         return this;
diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxSpinnerFieldPanel.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxSpinnerFieldPanel.java
index 9521f5f..125a936 100644
--- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxSpinnerFieldPanel.java
+++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxSpinnerFieldPanel.java
@@ -181,7 +181,8 @@ public final class AjaxSpinnerFieldPanel<T extends Number> extends FieldPanel<T>
         return this;
     }
 
-    @SuppressWarnings("unchecked")
+    @SuppressWarnings({ "unchecked", "rawtypes" })
+    @Override
     public FieldPanel<T> setNewModel(final Attributable attributableTO, final String schema) {
         field.setModel(new Model() {
 
@@ -213,7 +214,6 @@ public final class AjaxSpinnerFieldPanel<T extends Number> extends FieldPanel<T>
                     attributableTO.getPlainAttr(schema).get().getValues().add(object.toString());
                 }
             }
-
         });
 
         return this;
diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/DateFieldPanel.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/DateFieldPanel.java
index d651784..3595494 100644
--- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/DateFieldPanel.java
+++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/DateFieldPanel.java
@@ -124,6 +124,7 @@ public abstract class DateFieldPanel extends FieldPanel<Date> {
     }
 
     @SuppressWarnings({ "unchecked", "rawtypes" })
+    @Override
     public FieldPanel<Date> setNewModel(final Attributable attributableTO, final String schema) {
         field.setModel(new Model() {
 
@@ -148,7 +149,6 @@ public abstract class DateFieldPanel extends FieldPanel<Date> {
                     attributableTO.getPlainAttr(schema).get().getValues().add(fmt.format(object));
                 }
             }
-
         });
 
         return this;
diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SyncopeWebApplication.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SyncopeWebApplication.java
index c28126a..ef8c8e3 100644
--- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SyncopeWebApplication.java
+++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SyncopeWebApplication.java
@@ -271,8 +271,20 @@ public class SyncopeWebApplication extends WicketBootSecuredWebApplication {
         if (BooleanUtils.toBoolean(props.getProperty("x-forward"))) {
             XForwardedRequestWrapperFactory.Config config = new XForwardedRequestWrapperFactory.Config();
             config.setProtocolHeader(props.getProperty("x-forward.protocol.header", HttpHeaders.X_FORWARDED_PROTO));
-            config.setHttpServerPort(Integer.valueOf(props.getProperty("x-forward.http.port", "80")));
-            config.setHttpsServerPort(Integer.valueOf(props.getProperty("x-forward.https.port", "443")));
+            try {
+                config.setHttpServerPort(Integer.valueOf(props.getProperty("x-forward.http.port", "80")));
+            } catch (NumberFormatException e) {
+                LOG.error("Invalid value provided for 'x-forward.http.port': {}",
+                        props.getProperty("x-forward.http.port"));
+                config.setHttpServerPort(80);
+            }
+            try {
+                config.setHttpsServerPort(Integer.valueOf(props.getProperty("x-forward.https.port", "443")));
+            } catch (NumberFormatException e) {
+                LOG.error("Invalid value provided for 'x-forward.https.port': {}",
+                        props.getProperty("x-forward.https.port"));
+                config.setHttpsServerPort(443);
+            }
 
             XForwardedRequestWrapperFactory factory = new XForwardedRequestWrapperFactory();
             factory.setConfig(config);
diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/batch/BatchContent.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/batch/BatchContent.java
index 8b6c2a7..7193aab 100644
--- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/batch/BatchContent.java
+++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/batch/BatchContent.java
@@ -38,7 +38,6 @@ import org.apache.syncope.client.console.rest.GroupRestClient;
 import org.apache.syncope.client.ui.commons.rest.RestClient;
 import org.apache.syncope.client.console.rest.UserRestClient;
 import org.apache.syncope.client.console.wicket.extensions.markup.html.repeater.data.table.BatchResponseColumn;
-import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal;
 import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink;
 import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel;
 import org.apache.syncope.client.lib.batch.BatchRequest;
@@ -89,19 +88,17 @@ public class BatchContent<T extends Serializable, S> extends MultilevelPanel.Sec
     private SortableDataProvider<T, S> dataProvider;
 
     public BatchContent(
-            final BaseModal<?> modal,
             final List<T> items,
             final List<IColumn<T, S>> columns,
             final Collection<ActionLink.ActionType> actions,
             final RestClient batchExecutor,
             final String keyFieldName) {
 
-        this(MultilevelPanel.SECOND_LEVEL_ID, modal, items, columns, actions, batchExecutor, keyFieldName);
+        this(MultilevelPanel.SECOND_LEVEL_ID, items, columns, actions, batchExecutor, keyFieldName);
     }
 
     public BatchContent(
             final String id,
-            final BaseModal<?> modal,
             final List<T> items,
             final List<IColumn<T, S>> columns,
             final Collection<ActionLink.ActionType> actions,
@@ -368,7 +365,6 @@ public class BatchContent<T extends Serializable, S> extends MultilevelPanel.Sec
 
     public BatchContent(
             final String id,
-            final BaseModal<T> modal,
             final List<T> items,
             final List<IColumn<T, S>> columns,
             final Map<String, String> results,
diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/batch/BatchModal.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/batch/BatchModal.java
index 706f44f..8d5b8d9 100644
--- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/batch/BatchModal.java
+++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/batch/BatchModal.java
@@ -44,7 +44,7 @@ public class BatchModal<T extends Serializable, S> extends AbstractModalPanel<T>
             final String keyFieldName) {
 
         super(modal, pageRef);
-        add(new BatchContent<>("content", modal, items, columns, actions, batchExecutor, keyFieldName).
+        add(new BatchContent<>("content", items, columns, actions, batchExecutor, keyFieldName).
                 setRenderBodyOnly(true));
     }
 
@@ -58,7 +58,7 @@ public class BatchModal<T extends Serializable, S> extends AbstractModalPanel<T>
             final AjaxRequestTarget target) {
 
         super(modal, pageRef);
-        add(new BatchContent<>("content", modal, items, columns, results, keyFieldName, target, pageRef).
+        add(new BatchContent<>("content", items, columns, results, keyFieldName, target, pageRef).
                 setRenderBodyOnly(true));
     }
 }
diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/panels/AjaxDataTablePanel.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/panels/AjaxDataTablePanel.java
index f820fe1..04010be 100644
--- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/panels/AjaxDataTablePanel.java
+++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/panels/AjaxDataTablePanel.java
@@ -271,7 +271,6 @@ public final class AjaxDataTablePanel<T extends Serializable, S> extends DataTab
                 } else {
                     builder.multiLevelPanel.next(getString("batch"),
                             new BatchContent<>(
-                                    builder.baseModal,
                                     new ArrayList<>(group.getModelObject()),
                                     builder.columns.size() == 1
                                     ? builder.columns
diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/panels/FailureMessageModal.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/panels/FailureMessageModal.java
deleted file mode 100644
index 601e796..0000000
--- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/panels/FailureMessageModal.java
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.syncope.client.console.panels;
-
-import java.io.Serializable;
-import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal;
-import org.apache.syncope.client.ui.commons.panels.ModalPanel;
-import org.apache.wicket.PageReference;
-import org.apache.wicket.markup.html.basic.Label;
-import org.apache.wicket.markup.html.panel.Panel;
-import org.apache.wicket.model.Model;
-
-public class FailureMessageModal<T extends Serializable> extends Panel implements ModalPanel {
-
-    private static final long serialVersionUID = 9216117990503199258L;
-
-    public FailureMessageModal(final PageReference pageRef, final String failureMessage) {
-        super(BaseModal.CONTENT_ID);
-        final Label executionFailureMessage;
-        if (!failureMessage.isEmpty()) {
-            executionFailureMessage = new Label("failureMessage", new Model<>(failureMessage));
-        } else {
-            executionFailureMessage = new Label("failureMessage");
-        }
-        add(executionFailureMessage.setOutputMarkupId(true));
-    }
-}
diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/panels/ImplementationEngineTogglePanel.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/panels/ImplementationEngineTogglePanel.java
index 744453c..8aece7a 100644
--- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/panels/ImplementationEngineTogglePanel.java
+++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/panels/ImplementationEngineTogglePanel.java
@@ -80,5 +80,4 @@ public abstract class ImplementationEngineTogglePanel extends TogglePanel<Serial
     public void setHeaderLabel(final AjaxRequestTarget target) {
         setHeader(target, getString("engine"));
     }
-
 }
diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/wizards/any/AnyWizardBuilder.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/wizards/any/AnyWizardBuilder.java
index e321300..72fca74 100644
--- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/wizards/any/AnyWizardBuilder.java
+++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/wizards/any/AnyWizardBuilder.java
@@ -117,7 +117,7 @@ public abstract class AnyWizardBuilder<A extends AnyTO> extends AbstractAnyWizar
         // attributes panel steps
         if (formLayoutInfo.isPlainAttrs()) {
             wizardModel.add(
-                    new PlainAttrs(modelObject, null, mode, anyTypeClasses, formLayoutInfo.getWhichPlainAttrs()) {
+                    new PlainAttrs(modelObject, mode, anyTypeClasses, formLayoutInfo.getWhichPlainAttrs()) {
 
                 private static final long serialVersionUID = 8167894751609598306L;
 
diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/wizards/any/PlainAttrs.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/wizards/any/PlainAttrs.java
index d0b9932..d331e7a 100644
--- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/wizards/any/PlainAttrs.java
+++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/wizards/any/PlainAttrs.java
@@ -38,7 +38,6 @@ import org.apache.syncope.common.lib.to.UserTO;
 import org.apache.syncope.common.lib.types.SchemaType;
 import org.apache.wicket.extensions.markup.html.tabs.AbstractTab;
 import org.apache.wicket.markup.html.WebMarkupContainer;
-import org.apache.wicket.markup.html.form.Form;
 import org.apache.wicket.markup.html.list.ListItem;
 import org.apache.wicket.markup.html.list.ListView;
 import org.apache.wicket.model.IModel;
@@ -56,7 +55,6 @@ public class PlainAttrs extends AbstractAttrs<PlainSchemaTO> {
 
     public <T extends AnyTO> PlainAttrs(
             final AnyWrapper<T> modelObject,
-            final Form<?> form,
             final AjaxWizard.Mode mode,
             final List<String> anyTypeClasses,
             final List<String> whichPlainAttrs) throws IllegalArgumentException {
diff --git a/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/SyncopeWebApplication.java b/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/SyncopeWebApplication.java
index cd3c06b..90a4d4d 100644
--- a/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/SyncopeWebApplication.java
+++ b/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/SyncopeWebApplication.java
@@ -61,7 +61,7 @@ import org.apache.wicket.markup.head.CssHeaderItem;
 import org.apache.wicket.markup.head.IHeaderResponse;
 import org.apache.wicket.markup.html.IHeaderContributor;
 import org.apache.wicket.markup.html.WebPage;
-import org.apache.wicket.protocol.http.CsrfPreventionRequestCycleListener;
+import org.apache.wicket.protocol.http.ResourceIsolationRequestCycleListener;
 import org.apache.wicket.protocol.http.WebApplication;
 import org.apache.wicket.protocol.http.servlet.XForwardedRequestWrapperFactory;
 import org.apache.wicket.request.Request;
@@ -159,16 +159,45 @@ public class SyncopeWebApplication extends WicketBootStandardWebApplication {
 
         useGZIPCompression = BooleanUtils.toBoolean(props.getProperty("useGZIPCompression"));
         Args.notNull(useGZIPCompression, "<useGZIPCompression>");
-        maxUploadFileSizeMB = props.getProperty("maxUploadFileSizeMB") == null
-                ? null
-                : Integer.valueOf(props.getProperty("maxUploadFileSizeMB"));
 
-        maxWaitTime = Integer.valueOf(props.getProperty("maxWaitTimeOnApplyChanges", "30"));
+        try {
+            maxUploadFileSizeMB = Integer.valueOf(props.getProperty("maxUploadFileSizeMB", "4"));
+        } catch (NumberFormatException e) {
+            LOG.error("Invalid value provided for 'maxUploadFileSizeMB': {}",
+                    props.getProperty("maxUploadFileSizeMB"));
+            maxUploadFileSizeMB = 4;
+        }
+
+        try {
+            maxWaitTime = Integer.valueOf(props.getProperty("maxWaitTimeOnApplyChanges", "30"));
+        } catch (NumberFormatException e) {
+            LOG.error("Invalid value provided for 'maxWaitTimeOnApplyChanges': {}",
+                    props.getProperty("maxWaitTimeOnApplyChanges"));
+            maxWaitTime = 30;
+        }
 
         // Resource connections check thread pool size
-        corePoolSize = Integer.valueOf(props.getProperty("executor.corePoolSize", "5"));
-        maxPoolSize = Integer.valueOf(props.getProperty("executor.maxPoolSize", "10"));
-        queueCapacity = Integer.valueOf(props.getProperty("executor.queueCapacity", "50"));
+        try {
+            corePoolSize = Integer.valueOf(props.getProperty("executor.corePoolSize", "5"));
+        } catch (NumberFormatException e) {
+            LOG.error("Invalid value provided for 'executor.corePoolSize': {}",
+                    props.getProperty("executor.corePoolSize"));
+            corePoolSize = 5;
+        }
+        try {
+            maxPoolSize = Integer.valueOf(props.getProperty("executor.maxPoolSize", "10"));
+        } catch (NumberFormatException e) {
+            LOG.error("Invalid value provided for 'executor.maxPoolSize': {}",
+                    props.getProperty("executor.maxPoolSize"));
+            maxPoolSize = 10;
+        }
+        try {
+            queueCapacity = Integer.valueOf(props.getProperty("executor.queueCapacity", "50"));
+        } catch (NumberFormatException e) {
+            LOG.error("Invalid value provided for 'executor.queueCapacity': {}",
+                    props.getProperty("executor.queueCapacity"));
+            maxPoolSize = 50;
+        }
 
         // read customFormAttributes.json
         File enduserDir;
@@ -295,8 +324,20 @@ public class SyncopeWebApplication extends WicketBootStandardWebApplication {
         if (BooleanUtils.toBoolean(props.getProperty("x-forward"))) {
             XForwardedRequestWrapperFactory.Config config = new XForwardedRequestWrapperFactory.Config();
             config.setProtocolHeader(props.getProperty("x-forward.protocol.header", HttpHeaders.X_FORWARDED_PROTO));
-            config.setHttpServerPort(Integer.valueOf(props.getProperty("x-forward.http.port", "80")));
-            config.setHttpsServerPort(Integer.valueOf(props.getProperty("x-forward.https.port", "443")));
+            try {
+                config.setHttpServerPort(Integer.valueOf(props.getProperty("x-forward.http.port", "80")));
+            } catch (NumberFormatException e) {
+                LOG.error("Invalid value provided for 'x-forward.http.port': {}",
+                        props.getProperty("x-forward.http.port"));
+                config.setHttpServerPort(80);
+            }
+            try {
+                config.setHttpsServerPort(Integer.valueOf(props.getProperty("x-forward.https.port", "443")));
+            } catch (NumberFormatException e) {
+                LOG.error("Invalid value provided for 'x-forward.https.port': {}",
+                        props.getProperty("x-forward.https.port"));
+                config.setHttpsServerPort(443);
+            }
 
             XForwardedRequestWrapperFactory factory = new XForwardedRequestWrapperFactory();
             factory.setConfig(config);
@@ -304,7 +345,7 @@ public class SyncopeWebApplication extends WicketBootStandardWebApplication {
         }
 
         if (BooleanUtils.toBoolean(props.getProperty("csrf"))) {
-            getRequestCycleListeners().add(new CsrfPreventionRequestCycleListener());
+            getRequestCycleListeners().add(new ResourceIsolationRequestCycleListener());
         }
         getRequestCycleListeners().add(new IRequestCycleListener() {
 
diff --git a/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/wizards/any/AbstractAttrs.java b/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/wizards/any/AbstractAttrs.java
index c8d1580..be2c63d 100644
--- a/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/wizards/any/AbstractAttrs.java
+++ b/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/wizards/any/AbstractAttrs.java
@@ -99,8 +99,9 @@ public abstract class AbstractAttrs<S extends SchemaTO> extends WizardStep imple
 
             for (MembershipTO membership : (List<MembershipTO>) PropertyResolver.getPropertyField(
                     "memberships", anyTO).get(anyTO)) {
-                setSchemas(Pair.of(membership.getGroupKey(), membership.getGroupName()), getMembershipAuxClasses(
-                        membership, anyTO.getType()));
+                setSchemas(
+                        Pair.of(membership.getGroupKey(), membership.getGroupName()),
+                        getMembershipAuxClasses(membership));
                 setAttrs(membership);
 
                 if (AbstractAttrs.this instanceof PlainAttrs && !membership.getPlainAttrs().isEmpty()) {
@@ -134,7 +135,7 @@ public abstract class AbstractAttrs<S extends SchemaTO> extends WizardStep imple
     protected List<String> getDefaultValues(final String schema) {
         return getDefaultValues(schema, null);
     }
-    
+
     protected List<String> getDefaultValues(final String schema, final String groupName) {
         String schemaName = (org.apache.commons.lang3.StringUtils.isBlank(groupName)
                 ? org.apache.commons.lang3.StringUtils.EMPTY
@@ -203,7 +204,7 @@ public abstract class AbstractAttrs<S extends SchemaTO> extends WizardStep imple
 
     protected abstract List<Attr> getAttrsFromTO(MembershipTO membershipTO);
 
-    protected static List<String> getMembershipAuxClasses(final MembershipTO membershipTO, final String anyType) {
+    protected static List<String> getMembershipAuxClasses(final MembershipTO membershipTO) {
         try {
             return SyncopeRestClient.searchUserTypeExtensions(membershipTO.getGroupName());
         } catch (Exception e) {
diff --git a/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/wizards/any/AnyWizardBuilder.java b/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/wizards/any/AnyWizardBuilder.java
index b768362..1494482 100644
--- a/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/wizards/any/AnyWizardBuilder.java
+++ b/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/wizards/any/AnyWizardBuilder.java
@@ -94,7 +94,6 @@ public abstract class AnyWizardBuilder extends AbstractAnyWizardBuilder<UserTO>
         wizardModel.add(new UserDetails(
                 UserWrapper.class.cast(modelObject),
                 mode == AjaxWizard.Mode.TEMPLATE,
-                modelObject.getInnerObject().getKey() != null,
                 UserFormLayoutInfo.class.cast(formLayoutInfo).isPasswordManagement(),
                 pageRef));
 
@@ -110,7 +109,6 @@ public abstract class AnyWizardBuilder extends AbstractAnyWizardBuilder<UserTO>
         if (formLayoutInfo.isPlainAttrs()) {
             wizardModel.add(new PlainAttrs(
                     modelObject,
-                    null,
                     mode,
                     anyTypeClasses,
                     formLayoutInfo.getWhichPlainAttrs()) {
diff --git a/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/wizards/any/PlainAttrs.java b/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/wizards/any/PlainAttrs.java
index 8d57bc3..5a5eeb1 100644
--- a/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/wizards/any/PlainAttrs.java
+++ b/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/wizards/any/PlainAttrs.java
@@ -60,7 +60,6 @@ import org.apache.wicket.PageReference;
 import org.apache.wicket.extensions.markup.html.tabs.AbstractTab;
 import org.apache.wicket.extensions.markup.html.tabs.ITab;
 import org.apache.wicket.markup.html.WebMarkupContainer;
-import org.apache.wicket.markup.html.form.Form;
 import org.apache.wicket.markup.html.form.IChoiceRenderer;
 import org.apache.wicket.markup.html.list.ListItem;
 import org.apache.wicket.markup.html.list.ListView;
@@ -84,7 +83,6 @@ public class PlainAttrs extends AbstractAttrs<PlainSchemaTO> {
 
     public <T extends AnyTO> PlainAttrs(
             final AnyWrapper<T> modelObject,
-            final Form<?> form,
             final AjaxWizard.Mode mode,
             final List<String> anyTypeClasses,
             final Map<String, CustomizationOption> whichPlainAttrs) throws IllegalArgumentException {
@@ -378,7 +376,7 @@ public class PlainAttrs extends AbstractAttrs<PlainSchemaTO> {
 
         panel.setReadOnly(readOnly);
         panel.setMarkupId(StringUtils.isBlank(groupName) ? schemaTO.getKey() : groupName + '.' + schemaTO.getKey());
-        
+
         return panel;
     }
 
@@ -423,7 +421,7 @@ public class PlainAttrs extends AbstractAttrs<PlainSchemaTO> {
                     } else {
                         FieldPanel.class.cast(panel).setNewModel(attrTO.getValues());
                     }
-                    
+
                     item.add(panel);
                 }
             });
diff --git a/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/wizards/any/UserDetails.java b/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/wizards/any/UserDetails.java
index 94197ed..11b61ff 100644
--- a/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/wizards/any/UserDetails.java
+++ b/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/wizards/any/UserDetails.java
@@ -74,7 +74,6 @@ public class UserDetails extends WizardStep {
     public UserDetails(
             final UserWrapper wrapper,
             final boolean templateMode,
-            final boolean includeStatusPanel,
             final boolean showPasswordManagement,
             final PageReference pageRef) {
         super();
diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java
index a3e1fc6..a7e9220 100644
--- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java
+++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java
@@ -402,7 +402,7 @@ public final class AnyOperations {
             if (patch.getAttr() == null) {
                 LOG.warn("Invalid {} specified: {}", AttrPatch.class.getName(), patch);
             } else {
-                Attr removed = rwattrs.remove(patch.getAttr().getSchema());
+                rwattrs.remove(patch.getAttr().getSchema());
                 if (patch.getOperation() == PatchOperation.ADD_REPLACE && !patch.getAttr().getValues().isEmpty()) {
                     rwattrs.put(patch.getAttr().getSchema(), patch.getAttr());
                 }
diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/SyncopeFiqlParser.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/SyncopeFiqlParser.java
index 4548584..e7e0191 100644
--- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/SyncopeFiqlParser.java
+++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/SyncopeFiqlParser.java
@@ -21,6 +21,7 @@ package org.apache.syncope.common.lib.search;
 import java.util.Map;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
+import org.apache.commons.lang3.StringUtils;
 
 import org.apache.cxf.jaxrs.ext.search.ConditionType;
 import org.apache.cxf.jaxrs.ext.search.SearchBean;
@@ -72,7 +73,7 @@ public class SyncopeFiqlParser<T> extends FiqlParser<T> {
             String propertyName = expr.substring(0, m.start(1));
             String operator = m.group(1);
             String value = expr.substring(m.end(1));
-            if ("".equals(value)) {
+            if (StringUtils.isBlank(value)) {
                 throw new SearchParseException("Not a comparison expression: " + expr);
             }
 
diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/auth/AbstractClientApp.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/auth/AbstractClientApp.java
index e5902e9..ef09634 100644
--- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/auth/AbstractClientApp.java
+++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/auth/AbstractClientApp.java
@@ -100,10 +100,12 @@ public class AbstractClientApp extends AbstractGeneratedKeyEntity implements Cli
         this.authPolicy = (JPAAuthPolicy) authPolicy;
     }
 
+    @Override
     public JPAAccessPolicy getAccessPolicy() {
         return accessPolicy;
     }
 
+    @Override
     public void setAccessPolicy(final AccessPolicy accessPolicy) {
         checkType(accessPolicy, JPAAccessPolicy.class);
         this.accessPolicy = (JPAAccessPolicy) accessPolicy;
diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/auth/JPACASSP.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/auth/JPACASSP.java
index 763930d..9198dad 100644
--- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/auth/JPACASSP.java
+++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/auth/JPACASSP.java
@@ -18,11 +18,10 @@
  */
 package org.apache.syncope.core.persistence.jpa.entity.auth;
 
-import org.apache.syncope.core.persistence.api.entity.auth.CASSP;
-
 import javax.persistence.Column;
 import javax.persistence.Entity;
 import javax.persistence.Table;
+import org.apache.syncope.core.persistence.api.entity.auth.CASSP;
 
 @Entity
 @Table(name = JPACASSP.TABLE)
@@ -35,10 +34,12 @@ public class JPACASSP extends AbstractClientApp implements CASSP {
     @Column(unique = true, nullable = false)
     private String serviceId;
 
+    @Override
     public String getServiceId() {
         return serviceId;
     }
 
+    @Override
     public void setServiceId(final String serviceId) {
         this.serviceId = serviceId;
     }
diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/openjpa/LocaleValueHandler.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/openjpa/LocaleValueHandler.java
index a85d845..eb25d35 100644
--- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/openjpa/LocaleValueHandler.java
+++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/openjpa/LocaleValueHandler.java
@@ -41,21 +41,16 @@ public class LocaleValueHandler extends AbstractValueHandler {
         return INSTANCE;
     }
 
-    /**
-     *
-     *
-     * @deprecated
-     */
     @Override
     @Deprecated
     public Column[] map(final ValueMapping vm, final String name, final ColumnIO io, final boolean adapt) {
         DBDictionary dict = vm.getMappingRepository().getDBDictionary();
-        DBIdentifier colName = DBIdentifier.newColumn(name, Optional.ofNullable(dict)
-            .filter(DBDictionary::delimitAll).isPresent());
-        return map(vm, colName, io, adapt);
+        DBIdentifier colName = DBIdentifier.newColumn(
+                name, Optional.ofNullable(dict).filter(DBDictionary::delimitAll).isPresent());
+        return map(colName);
     }
 
-    public static Column[] map(final ValueMapping vm, final DBIdentifier name, final ColumnIO io, final boolean adapt) {
+    public static Column[] map(final DBIdentifier name) {
         Column col = new Column();
         col.setIdentifier(name);
         col.setJavaType(JavaTypes.STRING);
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java
index baa598f..00de34e 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java
@@ -557,8 +557,7 @@ abstract class AbstractAnyDataBinder {
             final Collection<? extends PlainAttr<?>> plainAttrs,
             final Map<DerSchema, String> derAttrs,
             final Map<VirSchema, List<String>> virAttrs,
-            final Collection<? extends ExternalResource> resources,
-            final boolean details) {
+            final Collection<? extends ExternalResource> resources) {
 
         anyTO.setRealm(realmFullPath);
 
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java
index 3f2b43b..f1126fb 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java
@@ -97,8 +97,7 @@ public class AnyObjectDataBinderImpl extends AbstractAnyDataBinder implements An
                 anyObject.getPlainAttrs(),
                 derAttrHandler.getValues(anyObject),
                 virAttrValues,
-                anyObjectDAO.findAllResources(anyObject),
-                details);
+                anyObjectDAO.findAllResources(anyObject));
 
         // dynamic realms
         anyObjectTO.getDynRealms().addAll(anyObjectDAO.findDynRealms(anyObject.getKey()));
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/GroupDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/GroupDataBinderImpl.java
index 402a7e1..0554e65 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/GroupDataBinderImpl.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/GroupDataBinderImpl.java
@@ -357,8 +357,7 @@ public class GroupDataBinderImpl extends AbstractAnyDataBinder implements GroupD
                 group.getPlainAttrs(),
                 derAttrValues,
                 virAttrValues,
-                group.getResources(),
-                details);
+                group.getResources());
 
         // dynamic realms
         groupTO.getDynRealms().addAll(groupDAO.findDynRealms(group.getKey()));
diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java
index d760612..fe108f8 100644
--- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java
+++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java
@@ -740,8 +740,7 @@ public class UserDataBinderImpl extends AbstractAnyDataBinder implements UserDat
                 user.getPlainAttrs(),
                 derAttrHandler.getValues(user),
                 details ? virAttrHandler.getValues(user) : Map.of(),
-                userDAO.findAllResources(user),
-                details);
+                userDAO.findAllResources(user));
 
         // dynamic realms
         userTO.getDynRealms().addAll(userDAO.findDynRealms(user.getKey()));
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AbstractNotificationTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AbstractNotificationTaskITCase.java
index d900cff..ca96989 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AbstractNotificationTaskITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AbstractNotificationTaskITCase.java
@@ -86,7 +86,7 @@ public abstract class AbstractNotificationTaskITCase extends AbstractTaskITCase
             final int maxWaitSeconds) throws Exception {
 
         AtomicReference<Boolean> read = new AtomicReference<>(false);
-        await().atMost(MAX_WAIT_SECONDS, TimeUnit.SECONDS).pollInterval(1, TimeUnit.SECONDS).until(() -> {
+        await().atMost(maxWaitSeconds, TimeUnit.SECONDS).pollInterval(1, TimeUnit.SECONDS).until(() -> {
             try {
                 read.set(pop3(sender, subject, mailAddress));
                 return read.get();
diff --git a/sra/src/main/java/org/apache/syncope/sra/RouteProvider.java b/sra/src/main/java/org/apache/syncope/sra/RouteProvider.java
index a3679d7..7a9eec9 100644
--- a/sra/src/main/java/org/apache/syncope/sra/RouteProvider.java
+++ b/sra/src/main/java/org/apache/syncope/sra/RouteProvider.java
@@ -22,6 +22,7 @@ import java.time.ZonedDateTime;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Objects;
+import java.util.concurrent.atomic.AtomicInteger;
 import java.util.function.Consumer;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
@@ -282,8 +283,15 @@ public class RouteProvider {
                 break;
 
             case RETRY:
+                AtomicInteger retries = new AtomicInteger();
+                try {
+                    retries.set(Integer.valueOf(gwfilter.getArgs().trim()));
+                } catch (NumberFormatException e) {
+                    LOG.error("Unexpected argument value: {}", gwfilter.getArgs().trim(), e);
+                    retries.set(0);
+                }
                 filter = ctx.getBean(RetryGatewayFilterFactory.class).
-                        apply(c -> c.setRetries(Integer.valueOf(gwfilter.getArgs().trim())));
+                        apply(c -> c.setRetries(retries.get()));
                 break;
 
             case SAVE_SESSION:
@@ -321,8 +329,15 @@ public class RouteProvider {
                 break;
 
             case STRIP_PREFIX:
+                AtomicInteger parts = new AtomicInteger();
+                try {
+                    parts.set(Integer.valueOf(gwfilter.getArgs().trim()));
+                } catch (NumberFormatException e) {
+                    LOG.error("Unexpected argument value: {}", gwfilter.getArgs().trim(), e);
+                    parts.set(0);
+                }
                 filter = ctx.getBean(StripPrefixGatewayFilterFactory.class).
-                        apply(c -> c.setParts(Integer.valueOf(gwfilter.getArgs().trim())));
+                        apply(c -> c.setParts(parts.get()));
                 break;
 
             case REQUEST_HEADER_TO_REQUEST_URI:
@@ -471,9 +486,16 @@ public class RouteProvider {
 
             case WEIGHT:
                 String[] weigthArgs = gwpredicate.getArgs().split(",");
+                AtomicInteger weight = new AtomicInteger();
+                try {
+                    weight.set(Integer.valueOf(weigthArgs[1].trim()));
+                } catch (NumberFormatException e) {
+                    LOG.error("Unexpected argument value: {}", weigthArgs[1].trim(), e);
+                    weight.set(0);
+                }
                 predicate = ctx.getBean(WeightRoutePredicateFactory.class).
                         applyAsync(c -> c.setGroup(weigthArgs[0].trim()).
-                        setWeight(Integer.valueOf(weigthArgs[1].trim())));
+                        setWeight(weight.get()));
                 break;
 
             case CUSTOM: