(ws-wss4j) branch 3_0_x-fixes updated: Fix a potential NPE with HSM based Crypto instances in the derived key parser (#670)

[coheigea]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch 3_0_x-fixes
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git


The following commit(s) were added to refs/heads/3_0_x-fixes by this push:
     new eda01329f Fix a potential NPE with HSM based Crypto instances in the 
derived key parser (#670)
eda01329f is described below

commit eda01329f0eb35044ddf08547877df0db7e6ba0a
Author: Colm O hEigeartaigh <cohei...@users.noreply.github.com>
AuthorDate: Fri Sep 4 07:56:35 2026 +0100

    Fix a potential NPE with HSM based Crypto instances in the derived key 
parser (#670)
---
 .../java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java  | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git 
a/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java
 
b/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java
index 2893a8785..fe6b34dca 100644
--- 
a/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java
+++ 
b/ws-security-dom/src/main/java/org/apache/wss4j/dom/str/DerivedKeyTokenSTRParser.java
@@ -189,7 +189,14 @@ public class DerivedKeyTokenSTRParser implements STRParser 
{
                     }
                     parserResult.setSecretKey(secretKey);
                 } else {
-                    byte[] secretKey = crypto.getPrivateKey(certs[0], 
data.getCallbackHandler()).getEncoded();
+                    java.security.PrivateKey privateKey = 
crypto.getPrivateKey(certs[0], data.getCallbackHandler());
+                    // HSM-backed keys are often non-extractable and return a 
null encoding
+                    byte[] secretKey = privateKey == null ? null : 
privateKey.getEncoded();
+                    if (secretKey == null || secretKey.length == 0) {
+                        throw new WSSecurityException(
+                            WSSecurityException.ErrorCode.FAILED_CHECK, 
"unsupportedKeyId",
+                            new Object[] {uri});
+                    }
                     parserResult.setSecretKey(secretKey);
                 }
             }