add check for null manifest assertions

opentdf · Nov 19, 2024 · 4541fbb · 4541fbb
1 parent 32825b0
commit 4541fbb
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 25 deletions.
diff --git a/sdk/src/main/java/io/opentdf/platform/sdk/Manifest.java b/sdk/src/main/java/io/opentdf/platform/sdk/Manifest.java
@@ -51,7 +51,8 @@ public boolean equals(Object o) {
             return false;
         Manifest manifest = (Manifest) o;
         return Objects.equals(encryptionInformation, manifest.encryptionInformation)
-                && Objects.equals(payload, manifest.payload) && Objects.equals(assertions, manifest.assertions);
+                && Objects.equals(payload, manifest.payload) 
+                && (manifest.assertions != null && Objects.equals(assertions, manifest.assertions));
     }
 
     @Override

diff --git a/sdk/src/main/java/io/opentdf/platform/sdk/TDF.java b/sdk/src/main/java/io/opentdf/platform/sdk/TDF.java
@@ -695,35 +695,37 @@ public Reader loadTDF(SeekableByteChannel tdf, SDK.KAS kas,
         }
 
         // Validate assertions
-        for (var assertion : manifest.assertions) {
-            // Skip assertion verification if disabled
-            if (tdfReaderConfig.disableAssertionVerification) {
-                break;
-            }
+        if (manifest.assertions != null) {
+            for (var assertion : manifest.assertions) {
+                // Skip assertion verification if disabled
+                if (tdfReaderConfig.disableAssertionVerification) {
+                    break;
+                }
 
-            // Set default to HS256
-            var assertionKey = new AssertionConfig.AssertionKey(AssertionConfig.AssertionKeyAlg.HS256, payloadKey);
-            Config.AssertionVerificationKeys assertionVerificationKeys = tdfReaderConfig.assertionVerificationKeys;
-            if (!assertionVerificationKeys.isEmpty()) {
-                var keyForAssertion = assertionVerificationKeys.getKey(assertion.id);
-                if (keyForAssertion != null) {
-                    assertionKey = keyForAssertion;
+                // Set default to HS256
+                var assertionKey = new AssertionConfig.AssertionKey(AssertionConfig.AssertionKeyAlg.HS256, payloadKey);
+                Config.AssertionVerificationKeys assertionVerificationKeys = tdfReaderConfig.assertionVerificationKeys;
+                if (!assertionVerificationKeys.isEmpty()) {
+                    var keyForAssertion = assertionVerificationKeys.getKey(assertion.id);
+                    if (keyForAssertion != null) {
+                        assertionKey = keyForAssertion;
+                    }
                 }
-            }
 
-            var hashValues = assertion.verify(assertionKey);
-            var assertionAsJson = gson.toJson(assertion);
-            JsonCanonicalizer jc = new JsonCanonicalizer(assertionAsJson);
-            var hashOfAssertion = Hex.encodeHexString(digest.digest(jc.getEncodedUTF8()));
-            var signature = aggregateHash + hashOfAssertion;
-            var encodeSignature = Base64.getEncoder().encodeToString(signature.getBytes());
+                var hashValues = assertion.verify(assertionKey);
+                var assertionAsJson = gson.toJson(assertion);
+                JsonCanonicalizer jc = new JsonCanonicalizer(assertionAsJson);
+                var hashOfAssertion = Hex.encodeHexString(digest.digest(jc.getEncodedUTF8()));
+                var signature = aggregateHash + hashOfAssertion;
+                var encodeSignature = Base64.getEncoder().encodeToString(signature.getBytes());
 
-            if (!Objects.equals(hashOfAssertion, hashValues.getAssertionHash())) {
-                throw new AssertionException("assertion hash mismatch", assertion.id);
-            }
+                if (!Objects.equals(hashOfAssertion, hashValues.getAssertionHash())) {
+                    throw new AssertionException("assertion hash mismatch", assertion.id);
+                }
 
-            if (!Objects.equals(encodeSignature, hashValues.getSignature())) {
-                throw new AssertionException("failed integrity check on assertion signature", assertion.id);
+                if (!Objects.equals(encodeSignature, hashValues.getSignature())) {
+                    throw new AssertionException("failed integrity check on assertion signature", assertion.id);
+                }
             }
         }