Fix NPE in convertDeprecatedCredentialsFormat when credential fields are null#49316
Fix NPE in convertDeprecatedCredentialsFormat when credential fields are null#49316nouhouari wants to merge 1 commit into
Conversation
c554865 to
4f8d8cd
Compare
…are null Validate required fields before converting deprecated credential format to prevent NullPointerException from Integer unboxing. Returns 400 Bad Request with a descriptive message instead of a 500 server error. Closes keycloak#41640 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: nouhouari <houarinourredine@gmail.com>
a4a46c8 to
8678b63
Compare
|
Hi @nouhouari, thank you for this fix. The approach is correct - this is a deprecated credential import path where the hash, salt, algorithm, iteration count (for passwords) and digits, counter, period, algorithm (for OTP) all come from an external source. Defaulting missing fields would silently create credentials that import successfully but fail at verification time (wrong I'd like to note that @vivekksk submitted essentially the same fix back in August 2025 (PR #41922), so please consider adding a Could you expand the test coverage? The current test covers the case where all credential fields are empty, but it would be good to also cover:
We'll proceed with merging this one once the tests are updated. Thanks! |
Summary
RepresentationToModel.convertDeprecatedCredentialsFormat()ModelException(returned as 400 Bad Request) instead of crashing with NPE (500 Internal Server Error)hashIterations,algorithm,hashedSaltedValue,salt) and OTP credentials (digits,counter,period,algorithm,hashedSaltedValue)Why
When creating a user via the Admin REST API with an incomplete deprecated credential payload (e.g.
{"type": "password"}with null value), theIntegerunboxing ofgetHashIterations()causes an uncaughtNullPointerException.Test plan
UsersTest#createUserWithIncompleteDeprecatedPasswordCredentialReturnsBadRequest./mvnw spotless:checkpassesAI Disclosure
This fix was developed with assistance from Claude Code (AI). The author has reviewed, understands, and can explain all changes.
Closes #41640