This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/dkt-npe in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
commit cca9ef27c83d329de2e7251f63bc4a0b72f57bd9 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Fri Sep 4 07:40:56 2026 +0100 Fix a potential NPE with HSM based Crypto instances in the derived key parser --- .../java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java b/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java index 2893a8785..fe6b34dca 100644 --- a/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java +++ b/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java @@ -189,7 +189,14 @@ public class DerivedKeyTokenSTRParser implements STRParser { } parserResult.setSecretKey(secretKey); } else { - byte[] secretKey = crypto.getPrivateKey(certs[0], data.getCallbackHandler()).getEncoded(); + java.security.PrivateKey privateKey = crypto.getPrivateKey(certs[0], data.getCallbackHandler()); + // HSM-backed keys are often non-extractable and return a null encoding + byte[] secretKey = privateKey == null ? null : privateKey.getEncoded(); + if (secretKey == null || secretKey.length == 0) { + throw new WSSecurityException( + WSSecurityException.ErrorCode.FAILED_CHECK, "unsupportedKeyId", + new Object[] {uri}); + } parserResult.setSecretKey(secretKey); } }
