[CXF-8907] java.lang.NullPointerException at AsymmetricBindingHandler.java

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 3.3.9, 3.4.10, 3.5.6, 3.6.1, 4.0.2
• Fix Version/s: 3.5.7, 3.6.2, 4.0.3, 3.4.11
• Component/s: JAX-RS Security
• Estimated Complexity: Unknown
• Assignee: Andriy Redko
• Reporter: Rich M
• Created: 27/Jul/23 16:12
• Updated: 18/Sep/23 18:48
• Resolved: 29/Jul/23 15:44

Description

I am facing an issue with CXF PolicyBasedWSS4JOutInterceptor. The class AsymmetricBindingHandler.java has a method getSAMLToken(). Previous version of this class (cxf-rt-ws-security-2.7.14.jar) had a null check for RECV_RESULTS, but the newer versions (using cxf-rt-ws-security-3.3.12.redhat-00001.jar) removed the null check, which now leads to NullPointerException.

Stacktrace:

Caused by: java.lang.NullPointerException
        at org.apache.cxf.ws.security.wss4j.policyhandlers.AsymmetricBindingHandler.getSAMLToken(AsymmetricBindingHandler.java:818) [cxf-rt-ws-security.jar:3.3.12.redhat-00001]
        at org.apache.cxf.ws.security.wss4j.policyhandlers.AsymmetricBindingHandler.doSignBeforeEncrypt(AsymmetricBindingHandler.java:159) [cxf-rt-ws-security.jar:3.3.12.redhat-00001]

 

Issue Links

• links to: GitHub Pull Request #1361