(ws-wss4j) branch 3_0_x-fixes updated: Some remaining codeql fixes (#755)

[coheigea]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch 3_0_x-fixes
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git


The following commit(s) were added to refs/heads/3_0_x-fixes by this push:
     new 1ca85d8bc Some remaining codeql fixes (#755)
1ca85d8bc is described below

commit 1ca85d8bcee0709484ffd06a4829743ca7760c95
Author: Colm O hEigeartaigh <cohei...@users.noreply.github.com>
AuthorDate: Wed Oct 14 16:29:54 2026 +0100

    Some remaining codeql fixes (#755)
---
 .../java/org/apache/wss4j/common/token/SecurityTokenReference.java   | 3 +++
 .../main/java/org/apache/wss4j/dom/processor/SignatureProcessor.java | 5 +++++
 .../src/test/java/org/apache/wss4j/dom/message/AttachmentTest.java   | 2 +-
 .../src/test/java/org/apache/wss4j/stax/test/AttachmentTest.java     | 2 +-
 4 files changed, 10 insertions(+), 2 deletions(-)

diff --git 
a/ws-security-common/src/main/java/org/apache/wss4j/common/token/SecurityTokenReference.java
 
b/ws-security-common/src/main/java/org/apache/wss4j/common/token/SecurityTokenReference.java
index 5eba043be..033ba47ef 100644
--- 
a/ws-security-common/src/main/java/org/apache/wss4j/common/token/SecurityTokenReference.java
+++ 
b/ws-security-common/src/main/java/org/apache/wss4j/common/token/SecurityTokenReference.java
@@ -569,6 +569,9 @@ public class SecurityTokenReference {
         if (result != 1) {
             bspEnforcer.handleBSPRule(BSPRule.R3061);
         }
+        if (child == null) {
+            throw new 
WSSecurityException(WSSecurityException.ErrorCode.INVALID_SECURITY);
+        }
         if ("KeyIdentifier".equals(child.getLocalName())
             && WSS4JConstants.WSSE_NS.equals(child.getNamespaceURI())) {
 
diff --git 
a/ws-security-dom/src/main/java/org/apache/wss4j/dom/processor/SignatureProcessor.java
 
b/ws-security-dom/src/main/java/org/apache/wss4j/dom/processor/SignatureProcessor.java
index 33d82ae09..6d2bbc4cc 100644
--- 
a/ws-security-dom/src/main/java/org/apache/wss4j/dom/processor/SignatureProcessor.java
+++ 
b/ws-security-dom/src/main/java/org/apache/wss4j/dom/processor/SignatureProcessor.java
@@ -166,6 +166,11 @@ public class SignatureProcessor implements Processor {
             if (result != 1) {
                 data.getBSPEnforcer().handleBSPRule(BSPRule.R5402);
             }
+            if (child == null) {
+                throw new WSSecurityException(
+                    WSSecurityException.ErrorCode.INVALID_SECURITY, 
"unsupportedKeyInfo"
+                );
+            }
 
             if 
(!(SecurityTokenReference.SECURITY_TOKEN_REFERENCE.equals(child.getLocalName())
                 && WSConstants.WSSE_NS.equals(child.getNamespaceURI()))) {
diff --git 
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/AttachmentTest.java
 
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/AttachmentTest.java
index 0af2ba779..4abda4970 100644
--- 
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/AttachmentTest.java
+++ 
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/AttachmentTest.java
@@ -823,7 +823,7 @@ public class AttachmentTest {
                 break;
             }
         }
-        assertFalse(attachmentEncData == null);
+        assertNotNull(attachmentEncData);
         attachmentEncData.setAttributeNS(null, "MimeType", 
"application/malicious");
         encryptedAttachments.get(0).getHeaders().put("X-Attacker-Controlled", 
"forged");
 
diff --git 
a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AttachmentTest.java 
b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AttachmentTest.java
index 677c80988..889a9ae47 100644
--- 
a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AttachmentTest.java
+++ 
b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AttachmentTest.java
@@ -913,7 +913,7 @@ public class AttachmentTest extends AbstractTestBase {
                 break;
             }
         }
-        assertFalse(attachmentEncData == null);
+        assertNotNull(attachmentEncData);
         attachmentEncData.setAttributeNS(null, "MimeType", 
"application/malicious");
         encryptedAttachments.get(0).getHeaders().put("X-Attacker-Controlled", 
"forged");