fix: handle user certificate without certificate policies extension - #131
Conversation
There was a problem hiding this comment.
🟢 Approval recommended
The fix is narrowly scoped, prevents the documented exception escape path, and is covered by targeted unit and integration-level tests.
Pull request overview
This PR fixes a certificate-policy validation edge case where certificates lacking the Certificate Policies extension could trigger a NullPointerException, allowing untrusted/self-signed inputs to bypass the expected AuthTokenException error hierarchy and short-circuit validation before trust/signature checks.
Changes:
- Add a null-guard in
SubjectCertificatePolicyValidatorso missing Certificate Policies extension is treated as “no disallowed policies”. - Add unit tests covering both the policy-validator behavior and end-to-end validator behavior (continues to trust check).
- Extend test certificate utilities with a dedicated certificate fixture that lacks the Certificate Policies extension.
File summaries
| File | Description |
|---|---|
src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePolicyValidator.java |
Prevents NPE by explicitly handling missing Certificate Policies extension and allowing validation to proceed. |
src/test/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePolicyValidatorTest.java |
Adds focused tests for allowed/disallowed policies and missing-extension behavior. |
src/test/java/eu/webeid/security/validator/AuthTokenCertificateTest.java |
Adds an integration-style regression test ensuring missing extension flows to trust validation. |
src/test/java/eu/webeid/security/testutil/Certificates.java |
Adds a reusable test certificate fixture without the Certificate Policies extension. |
Review details
- Files reviewed: 4/4 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Thank you for your contribution! We’ll test the changes and review the code in the near future. If everything looks as expected, then we plan to include and publish this as part of the 4.0.0 release. |
|
@ErkoRisthein, thanks a lot for your contribution! This is now tested and ready to merge. Can you please rebase to latest main and add a Signed-off-by tag to your commit as explained in contributing guide to conform to Certificate of Origin v1.1? |
SubjectCertificatePolicyValidator passed the extension value straight to JcaX509ExtensionUtils.parseExtensionValue(), which throws NullPointerException when the certificate has no certificate policies extension. As the policy check runs before the trust and signature checks, any client could trigger it by presenting a self-signed certificate without the extension, and the NullPointerException escaped the AuthTokenException hierarchy that callers handle. A certificate without the extension does not contain disallowed policies, so validation now continues to the trust check, matching the behaviour of the .NET validation library. Signed-off-by: Erko Risthein <erko@risthein.ee>
bbfa8bd to
e232d91
Compare
SubjectCertificatePolicyValidator passed the extension value straight to JcaX509ExtensionUtils.parseExtensionValue(), which throws NullPointerException when the certificate has no certificate policies extension. As the policy check runs before the trust and signature checks, any client could trigger it by presenting a self-signed certificate without the extension, and the NullPointerException escaped the AuthTokenException hierarchy that callers handle.
A certificate without the extension does not contain disallowed policies, so validation now continues to the trust check, matching the behaviour of the .NET validation library.
Signed-off-by: Erko Risthein erko@risthein.ee