Fix (APAR):  PI69325

Status:  Fix

Release:  9.0.0.1,9.0.0.0

Operating System:  AIX,HP-UX,IBM i,Linux,Solaris,Windows,z/OS

Supersedes Fixes:  

CMVC Defect:  xxxxxx

Byte size of APAR:  286450

Date: 2016-10-05

Abstract:  oauth emits nullpointerexception when no state parameter in request

Description/symptom of problem:  
PI69325 resolves the following problem:

ERROR DESCRIPTION:                                              
The following error stack might occur when using OAuth:         
[9/13/16 16:44:07:936 EDT] 000000dd ServletWrappe E             
                                                                
com.ibm.ws.webcontainer.servlet.ServletWrapper service          
SRVE0068E: An exception was thrown by one of the service        
methods of the servlet [OAuth20EndpointServlet] in application  
[WebSphereOauth20SP]. Exception created :                       
[java.lang.NullPointerException                                 
at java.net.URLEncoder.encode(URLEncoder.java:225)              
at java.net.URLEncoder.encode(URLEncoder.java:189)              
at                                                              
com.ibm.ws.security.oauth20.form.FormRenderer.renderForm(FormR  
enderer.java:97)                                                
at                                                              
com.ibm.ws.security.oauth20.web.OAuth20EndpointServlet.renderCon
sentForm(OAuth20EndpointServlet.java:718)                       
at                                                              
com.ibm.ws.security.oauth20.web.OAuth20EndpointServlet.process  
AuthorizationRequest(OAuth20EndpointServlet.java:233)           

LOCAL FIX:                                                      
N/A                                                             

PROBLEM SUMMARY

USERS AFFECTED:
 IBM WebSphere Application Server users of
OAuth

PROBLEM DESCRIPTION:
If the OAuth provider receives
a request that does not contain a
state parameter, an NPE may occur.

RECOMMENDATION:
 Install a fix pack or interim fix that
contains this APAR.

If the OAuth provider receives a request that does not contain
a state parameter, a NullPointerException may occur. You might
see an entry like the following in SystemOut.log:
[9/30/16 9:40:02:411 EDT] 000001af ServletWrappe E
com.ibm.ws.webcontainer.servlet.ServletWrapper service
SRVE0068E: An exception was thrown by one of the service
methods of the servlet [OAuth20EndpointServlet] in application
[WebSphereOauth20SP]. Exception created :
[java.lang.NullPointerException
at java.net.URLEncoder.encode(URLEncoder.java:197)
at java.net.URLEncoder.encode(URLEncoder.java:161)
at
com.ibm.ws.security.oauth20.form.FormRenderer.renderForm(FormRen
derer.java:97)
at
com.ibm.ws.security.oauth20.web.OAuth20EndpointServlet.renderCon
sentForm(OAuth20EndpointServlet.java:718)
at
com.ibm.ws.security.oauth20.web.OAuth20EndpointServlet.processAu
thorizationRequest(OAuth20EndpointServlet.java:233)
at
com.ibm.ws.security.oauth20.web.OAuth20EndpointServlet.doPost(OA
uth20EndpointServlet.java:158)
at
com.ibm.ws.security.oauth20.web.OAuth20EndpointServlet.doGet(OAu
th20EndpointServlet.java:129)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:575)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:668)
...

PROBLEM CONCLUSION:                                             
If there is no state parameter in the OAuth request, a null is  
passed to the URLEncoder.encode method.  Depending on the       
JDK, that method may emit a NullPointerException when it        
receives a null parameter.                                      
                                                                
The OAuth provider is updated to not attempt to encode the      
state parameter if it does not exist.                           
                                                                
The fix for this APAR is currently targeted for inclusion in    
fix packs 7.0.0.43, 8.0.0.13, 8.5.5.11 and 9.0.0.2.  Please     
refer to the Recommended Updates page for delivery information: 
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980   


Directions to apply fix:  
Install Fix to all WebSphere installations unless special instructions are included below.

Special Instructions: None

NOTE:
The user must:
* Logged in with the same authority level when unpacking a fix, fix pack or refresh pack.
* Be at V1.8.5 or newer of the Installation Manager. Certain iFixes may require a newer version of the Installation Manager and the Installation Manager will inform you during the installation process if a newer version is required.

The IBM Information Center can provide details, if needed, on the use of the Installation Manager to apply the iFixes.
http://www.ibm.com/support/knowledgecenter/SSDV2W_1.8.5/com.ibm.cic.agent.ui.doc/helpindex_imic.html.  Shutdown WebSphere Application Server before applying the iFixes.  Restart WebSphere Application Server after applying the iFixes.

Directions to remove fix:  

The IBM Information Center can provide details, if needed, on the use of the Installation Manager to remove the iFixes.
http://www.ibm.com/support/knowledgecenter/SSDV2W_1.8.5/com.ibm.cic.agent.ui.doc/helpindex_imic.html.  Shutdown WebSphere Application Server before removing the iFixes.  Restart WebSphere Application Server after removing the iFixes.

Directions to re-apply fix:  
1) Shutdown WebSphere Application Server.

2) Follow the Fix instructions to apply the fix.

3) Restart WebSphere Application Server.



Additional Information: