(tomee) branch main updated: security/openid: guard null context path in cookie-based storage

[rz...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rzo1 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomee.git


The following commit(s) were added to refs/heads/main by this push:
     new cf273fff30 security/openid: guard null context path in cookie-based storage
cf273fff30 is described below

commit cf273fff302c7113c515e0059ddf99c54b4c895b
Author: Richard Zowalla <rz...@apache.org>
AuthorDate: Fri May 22 20:02:34 2026 +0200

    security/openid: guard null context path in cookie-based storage
    
    CookieBasedOpenIdStorageHandler.contextPath() called String.isEmpty()
    directly on HttpServletRequest.getContextPath(), throwing an NPE when
    the value is null. Treat null the same as the empty root-context path
    and fall back to "/". Fixes the six CookieBased/DefinitionAware
    OpenIdStorageHandler unit tests that mock the request.
---
 .../cdi/openid/storage/impl/CookieBasedOpenIdStorageHandler.java       | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tomee/tomee-security/src/main/java/org/apache/tomee/security/cdi/openid/storage/impl/CookieBasedOpenIdStorageHandler.java b/tomee/tomee-security/src/main/java/org/apache/tomee/security/cdi/openid/storage/impl/CookieBasedOpenIdStorageHandler.java
index ed79eb7b5a..bc1b6ab979 100644
--- a/tomee/tomee-security/src/main/java/org/apache/tomee/security/cdi/openid/storage/impl/CookieBasedOpenIdStorageHandler.java
+++ b/tomee/tomee-security/src/main/java/org/apache/tomee/security/cdi/openid/storage/impl/CookieBasedOpenIdStorageHandler.java
@@ -37,7 +37,8 @@ public class CookieBasedOpenIdStorageHandler extends OpenIdStorageHandler {
 
     private static String contextPath(HttpServletRequest request) {
         String ctx = request.getContextPath();
-        return ctx.isEmpty() ? "/" : ctx;
+        // Servlet containers return "" for the root context; guard null defensively too.
+        return (ctx == null || ctx.isEmpty()) ? "/" : ctx;
     }
 
     private static boolean isSecureCookieEnabled() {