Serialization issue in SAMLEntityAttributesParser - no void constructor in superclass. SAST

Description

A serializable class that is a subclass of a non-serializable class cannot be deserialized if its superclass does not declare a no-argument constructor. The Java serialization framework uses the no-argument constructor when it initializes the object instance that is created during deserialization. Deserialization fails with an InvalidClassException if its superclass does not declare a no-argument constructor.

The Java Development Kit API documentation states:

To allow subtypes of non-serializable classes to be serialized, the subtype may assume responsibility for saving and restoring the state of the supertype’s public, protected, and (if accessible) package fields. The subtype may assume this responsibility only if the class it extends has an accessible no-arg constructor to initialize the class’s state. It is an error to declare a class Serializable if this is not the case. The error will be detected at runtime.

Discussion

No response

Motivation

No response

Details

SAMLEntityAttributesParser is Serializable but its superclass doesn't define an accessible void constructor

keycloak/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/saml/mdattr/SAMLEntityAttributesParser.java

Lines 16 to 46 in bacba00

    
           public class SAMLEntityAttributesParser extends AbstractStaxSamlMetadataParser<EntityAttributes> implements Serializable { 
        
               private static final SAMLEntityAttributesParser INSTANCE = new SAMLEntityAttributesParser(); 
        
               private SAMLEntityAttributesParser() { 
        
                   super(SAMLMetadataQNames.ENTITY_ATTRIBUTES); 
        
               } 
        
               public static SAMLEntityAttributesParser getInstance() { 
        
                   return INSTANCE; 
        
               } 
        
               @Override 
        
               protected EntityAttributes instantiateElement(XMLEventReader xmlEventReader, StartElement element) throws ParsingException { 
        
                   return new EntityAttributes(); 
        
               } 
        
               @Override 
        
               protected void processSubElement(XMLEventReader xmlEventReader, EntityAttributes target, SAMLMetadataQNames element, 
        
                   StartElement elementDetail) throws ParsingException { 
        
                   switch (element) { 
        
                       case ATTRIBUTE: 
        
                           target.addAttribute(SAMLAttributeParser.getInstance().parse(xmlEventReader)); 
        
                           break; 
        
                       case ASSERTION: 
        
                           target.addAssertion(SAMLAssertionParser.getInstance().parse(xmlEventReader)); 
        
                           break; 
        
                       default: 
        
                           throw LOGGER.parserUnknownTag(StaxParserUtil.getElementName(elementDetail), elementDetail.getLocation()); 
        
                   } 
        
               } 
        
           }

Found by Linux Verification Center with SVACE

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Description

Discussion

Motivation

Details

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	public class SAMLEntityAttributesParser extends AbstractStaxSamlMetadataParser<EntityAttributes> implements Serializable {
	private static final SAMLEntityAttributesParser INSTANCE = new SAMLEntityAttributesParser();

	private SAMLEntityAttributesParser() {
	super(SAMLMetadataQNames.ENTITY_ATTRIBUTES);
	}

	public static SAMLEntityAttributesParser getInstance() {
	return INSTANCE;
	}

	@Override
	protected EntityAttributes instantiateElement(XMLEventReader xmlEventReader, StartElement element) throws ParsingException {
	return new EntityAttributes();
	}

	@Override
	protected void processSubElement(XMLEventReader xmlEventReader, EntityAttributes target, SAMLMetadataQNames element,
	StartElement elementDetail) throws ParsingException {
	switch (element) {
	case ATTRIBUTE:
	target.addAttribute(SAMLAttributeParser.getInstance().parse(xmlEventReader));
	break;
	case ASSERTION:
	target.addAssertion(SAMLAssertionParser.getInstance().parse(xmlEventReader));
	break;
	default:
	throw LOGGER.parserUnknownTag(StaxParserUtil.getElementName(elementDetail), elementDetail.getLocation());
	}
	}
	}

Description

Description

Discussion

Motivation

Details

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions