fix: handle user certificate without certificate policies extension - #131
Open
ErkoRisthein wants to merge 1 commit into
Open
fix: handle user certificate without certificate policies extension#131ErkoRisthein wants to merge 1 commit into
ErkoRisthein wants to merge 1 commit into
Conversation
SubjectCertificatePolicyValidator passed the extension value straight to JcaX509ExtensionUtils.parseExtensionValue(), which throws NullPointerException when the certificate has no certificate policies extension. As the policy check runs before the trust and signature checks, any client could trigger it by presenting a self-signed certificate without the extension, and the NullPointerException escaped the AuthTokenException hierarchy that callers handle. A certificate without the extension does not contain disallowed policies, so validation now continues to the trust check, matching the behaviour of the .NET validation library.
There was a problem hiding this comment.
🟢 Approval recommended
The fix is narrowly scoped, prevents the documented exception escape path, and is covered by targeted unit and integration-level tests.
Pull request overview
This PR fixes a certificate-policy validation edge case where certificates lacking the Certificate Policies extension could trigger a NullPointerException, allowing untrusted/self-signed inputs to bypass the expected AuthTokenException error hierarchy and short-circuit validation before trust/signature checks.
Changes:
- Add a null-guard in
SubjectCertificatePolicyValidatorso missing Certificate Policies extension is treated as “no disallowed policies”. - Add unit tests covering both the policy-validator behavior and end-to-end validator behavior (continues to trust check).
- Extend test certificate utilities with a dedicated certificate fixture that lacks the Certificate Policies extension.
File summaries
| File | Description |
|---|---|
src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePolicyValidator.java |
Prevents NPE by explicitly handling missing Certificate Policies extension and allowing validation to proceed. |
src/test/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePolicyValidatorTest.java |
Adds focused tests for allowed/disallowed policies and missing-extension behavior. |
src/test/java/eu/webeid/security/validator/AuthTokenCertificateTest.java |
Adds an integration-style regression test ensuring missing extension flows to trust validation. |
src/test/java/eu/webeid/security/testutil/Certificates.java |
Adds a reusable test certificate fixture without the Certificate Policies extension. |
Review details
- Files reviewed: 4/4 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SubjectCertificatePolicyValidator passed the extension value straight to JcaX509ExtensionUtils.parseExtensionValue(), which throws NullPointerException when the certificate has no certificate policies extension. As the policy check runs before the trust and signature checks, any client could trigger it by presenting a self-signed certificate without the extension, and the NullPointerException escaped the AuthTokenException hierarchy that callers handle.
A certificate without the extension does not contain disallowed policies, so validation now continues to the trust check, matching the behaviour of the .NET validation library.
Signed-off-by: Erko Risthein erko@risthein.ee