[SANTUARIO-465] SignedInfo Reference constructor does not check for case of zero child elements

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Java 2.0.8
• Fix Version/s: Java 2.1.0, Java 2.0.9
• Component/s: Java
• External issue URL: https://issues.shibboleth.net/jira/browse/OSJ-211
• Assignee: Colm O hEigeartaigh
• Reporter: Brent Putman
• Created: 07/Jun/17 21:14
• Updated: 28/Aug/17 13:51
• Resolved: 08/Jun/17 10:02

Description

The Reference constructor does not check for the case where the parsed DOM contains zero child elements, and winds up throwing a NullPointerException in this case. Since the constructor's signature does specify to throw a checked XMLSecurityException, it should probably check and throw that instead, as it already does for the case of an invalid # of transforms.

This was originally reported to OpenSAML by someone else. More details in the linked external issue.