fix: handle user certificate without certificate policies extension

[ErkoRisthein]

SubjectCertificatePolicyValidator passed the extension value straight to JcaX509ExtensionUtils.parseExtensionValue(), which throws NullPointerException when the certificate has no certificate policies extension. As the policy check runs before the trust and signature checks, any client could trigger it by presenting a self-signed certificate without the extension, and the NullPointerException escaped the AuthTokenException hierarchy that callers handle.

A certificate without the extension does not contain disallowed policies, so validation now continues to the trust check, matching the behaviour of the .NET validation library.

Signed-off-by: Erko Risthein erko@risthein.ee

[Copilot]

🟢 Approval recommended

The fix is narrowly scoped, prevents the documented exception escape path, and is covered by targeted unit and integration-level tests.

Pull request overview

This PR fixes a certificate-policy validation edge case where certificates lacking the Certificate Policies extension could trigger a NullPointerException, allowing untrusted/self-signed inputs to bypass the expected AuthTokenException error hierarchy and short-circuit validation before trust/signature checks.

Changes:

• Add a null-guard in SubjectCertificatePolicyValidator so missing Certificate Policies extension is treated as “no disallowed policies”.
• Add unit tests covering both the policy-validator behavior and end-to-end validator behavior (continues to trust check).
• Extend test certificate utilities with a dedicated certificate fixture that lacks the Certificate Policies extension.

File summaries

File	Description
src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePolicyValidator.java	Prevents NPE by explicitly handling missing Certificate Policies extension and allowing validation to proceed.
src/test/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePolicyValidatorTest.java	Adds focused tests for allowed/disallowed policies and missing-extension behavior.
src/test/java/eu/webeid/security/validator/AuthTokenCertificateTest.java	Adds an integration-style regression test ensuring missing extension flows to trust validation.
src/test/java/eu/webeid/security/testutil/Certificates.java	Adds a reusable test certificate fixture without the Certificate Policies extension.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.