The following issues were found

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/http/converter/OAuth2TokenIntrospectionHttpMessageConverter.java
10 issues
Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 62 

              	private static final ParameterizedTypeReference<Map<String, Object>> STRING_OBJECT_MAP = new ParameterizedTypeReference<Map<String, Object>>() {
	};

	private final GenericHttpMessageConverter<Object> jsonMessageConverter = HttpMessageConverters.getJsonMessageConverter();

	private Converter<Map<String, Object>, OAuth2TokenIntrospection> tokenIntrospectionConverter = new MapOAuth2TokenIntrospectionConverter();
	private Converter<OAuth2TokenIntrospection, Map<String, Object>> tokenIntrospectionParametersConverter = new OAuth2TokenIntrospectionMapConverter();

	public OAuth2TokenIntrospectionHttpMessageConverter() {

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 64 

              
	private final GenericHttpMessageConverter<Object> jsonMessageConverter = HttpMessageConverters.getJsonMessageConverter();

	private Converter<Map<String, Object>, OAuth2TokenIntrospection> tokenIntrospectionConverter = new MapOAuth2TokenIntrospectionConverter();
	private Converter<OAuth2TokenIntrospection, Map<String, Object>> tokenIntrospectionParametersConverter = new OAuth2TokenIntrospectionMapConverter();

	public OAuth2TokenIntrospectionHttpMessageConverter() {
		super(MediaType.APPLICATION_JSON, new MediaType("application", "*+json"));
	}

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 65 

              	private final GenericHttpMessageConverter<Object> jsonMessageConverter = HttpMessageConverters.getJsonMessageConverter();

	private Converter<Map<String, Object>, OAuth2TokenIntrospection> tokenIntrospectionConverter = new MapOAuth2TokenIntrospectionConverter();
	private Converter<OAuth2TokenIntrospection, Map<String, Object>> tokenIntrospectionParametersConverter = new OAuth2TokenIntrospectionMapConverter();

	public OAuth2TokenIntrospectionHttpMessageConverter() {
		super(MediaType.APPLICATION_JSON, new MediaType("application", "*+json"));
	}

Reported by PMD.

Avoid catching generic exceptions such as NullPointerException, RuntimeException, Exception in try-catch block
Design

Line: 84 

              			Map<String, Object> tokenIntrospectionParameters = (Map<String, Object>) this.jsonMessageConverter
					.read(STRING_OBJECT_MAP.getType(), null, inputMessage);
			return this.tokenIntrospectionConverter.convert(tokenIntrospectionParameters);
		} catch (Exception ex) {
			throw new HttpMessageNotReadableException(
					"An error occurred reading the Token Introspection Response: " + ex.getMessage(), ex, inputMessage);
		}
	}

Reported by PMD.

Avoid catching generic exceptions such as NullPointerException, RuntimeException, Exception in try-catch block
Design

Line: 98 

              					.convert(tokenIntrospection);
			this.jsonMessageConverter.write(tokenIntrospectionResponseParameters, STRING_OBJECT_MAP.getType(),
					MediaType.APPLICATION_JSON, outputMessage);
		} catch (Exception ex) {
			throw new HttpMessageNotWritableException(
					"An error occurred writing the Token Introspection Response: " + ex.getMessage(), ex);
		}
	}

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 137 

              		private static final TypeDescriptor STRING_TYPE_DESCRIPTOR = TypeDescriptor.valueOf(String.class);
		private static final TypeDescriptor INSTANT_TYPE_DESCRIPTOR = TypeDescriptor.valueOf(Instant.class);
		private static final TypeDescriptor URL_TYPE_DESCRIPTOR = TypeDescriptor.valueOf(URL.class);
		private final ClaimTypeConverter claimTypeConverter;

		private MapOAuth2TokenIntrospectionConverter() {
			Converter<Object, ?> booleanConverter = getConverter(BOOLEAN_TYPE_DESCRIPTOR);
			Converter<Object, ?> stringConverter = getConverter(STRING_TYPE_DESCRIPTOR);
			Converter<Object, ?> instantConverter = getConverter(INSTANT_TYPE_DESCRIPTOR);

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 166 

              		@Override
		public OAuth2TokenIntrospection convert(Map<String, Object> source) {
			Map<String, Object> parsedClaims = this.claimTypeConverter.convert(source);
			return OAuth2TokenIntrospection.withClaims(parsedClaims).build();
		}

		private static Converter<Object, ?> getConverter(TypeDescriptor targetDescriptor) {
			return (source) -> CLAIM_CONVERSION_SERVICE.convert(source, OBJECT_TYPE_DESCRIPTOR, targetDescriptor);
		}

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 191 

              				responseClaims.put(OAuth2TokenIntrospectionClaimNames.SCOPE, StringUtils.collectionToDelimitedString(source.getScopes(), " "));
			}
			if (source.getExpiresAt() != null) {
				responseClaims.put(OAuth2TokenIntrospectionClaimNames.EXP, source.getExpiresAt().getEpochSecond());
			}
			if (source.getIssuedAt() != null) {
				responseClaims.put(OAuth2TokenIntrospectionClaimNames.IAT, source.getIssuedAt().getEpochSecond());
			}
			if (source.getNotBefore() != null) {

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 194 

              				responseClaims.put(OAuth2TokenIntrospectionClaimNames.EXP, source.getExpiresAt().getEpochSecond());
			}
			if (source.getIssuedAt() != null) {
				responseClaims.put(OAuth2TokenIntrospectionClaimNames.IAT, source.getIssuedAt().getEpochSecond());
			}
			if (source.getNotBefore() != null) {
				responseClaims.put(OAuth2TokenIntrospectionClaimNames.NBF, source.getNotBefore().getEpochSecond());
			}
			return responseClaims;

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 197 

              				responseClaims.put(OAuth2TokenIntrospectionClaimNames.IAT, source.getIssuedAt().getEpochSecond());
			}
			if (source.getNotBefore() != null) {
				responseClaims.put(OAuth2TokenIntrospectionClaimNames.NBF, source.getNotBefore().getEpochSecond());
			}
			return responseClaims;
		}
	}

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2AuthorizationCodeAuthenticationConverter.java
10 issues
Potential violation of Law of Demeter (static property access)
Design

Line: 52 

              	public Authentication convert(HttpServletRequest request) {
		// grant_type (REQUIRED)
		String grantType = request.getParameter(OAuth2ParameterNames.GRANT_TYPE);
		if (!AuthorizationGrantType.AUTHORIZATION_CODE.getValue().equals(grantType)) {
			return null;
		}

		Authentication clientPrincipal = SecurityContextHolder.getContext().getAuthentication();

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 52 

              	public Authentication convert(HttpServletRequest request) {
		// grant_type (REQUIRED)
		String grantType = request.getParameter(OAuth2ParameterNames.GRANT_TYPE);
		if (!AuthorizationGrantType.AUTHORIZATION_CODE.getValue().equals(grantType)) {
			return null;
		}

		Authentication clientPrincipal = SecurityContextHolder.getContext().getAuthentication();

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 56 

              			return null;
		}

		Authentication clientPrincipal = SecurityContextHolder.getContext().getAuthentication();

		MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);

		// code (REQUIRED)
		String code = parameters.getFirst(OAuth2ParameterNames.CODE);

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 61 

              		MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);

		// code (REQUIRED)
		String code = parameters.getFirst(OAuth2ParameterNames.CODE);
		if (!StringUtils.hasText(code) ||
				parameters.get(OAuth2ParameterNames.CODE).size() != 1) {
			OAuth2EndpointUtils.throwError(
					OAuth2ErrorCodes.INVALID_REQUEST,
					OAuth2ParameterNames.CODE,

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 63 

              		// code (REQUIRED)
		String code = parameters.getFirst(OAuth2ParameterNames.CODE);
		if (!StringUtils.hasText(code) ||
				parameters.get(OAuth2ParameterNames.CODE).size() != 1) {
			OAuth2EndpointUtils.throwError(
					OAuth2ErrorCodes.INVALID_REQUEST,
					OAuth2ParameterNames.CODE,
					OAuth2EndpointUtils.ACCESS_TOKEN_REQUEST_ERROR_URI);
		}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 63 

              		// code (REQUIRED)
		String code = parameters.getFirst(OAuth2ParameterNames.CODE);
		if (!StringUtils.hasText(code) ||
				parameters.get(OAuth2ParameterNames.CODE).size() != 1) {
			OAuth2EndpointUtils.throwError(
					OAuth2ErrorCodes.INVALID_REQUEST,
					OAuth2ParameterNames.CODE,
					OAuth2EndpointUtils.ACCESS_TOKEN_REQUEST_ERROR_URI);
		}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 72 

              
		// redirect_uri (REQUIRED)
		// Required only if the "redirect_uri" parameter was included in the authorization request
		String redirectUri = parameters.getFirst(OAuth2ParameterNames.REDIRECT_URI);
		if (StringUtils.hasText(redirectUri) &&
				parameters.get(OAuth2ParameterNames.REDIRECT_URI).size() != 1) {
			OAuth2EndpointUtils.throwError(
					OAuth2ErrorCodes.INVALID_REQUEST,
					OAuth2ParameterNames.REDIRECT_URI,

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 74 

              		// Required only if the "redirect_uri" parameter was included in the authorization request
		String redirectUri = parameters.getFirst(OAuth2ParameterNames.REDIRECT_URI);
		if (StringUtils.hasText(redirectUri) &&
				parameters.get(OAuth2ParameterNames.REDIRECT_URI).size() != 1) {
			OAuth2EndpointUtils.throwError(
					OAuth2ErrorCodes.INVALID_REQUEST,
					OAuth2ParameterNames.REDIRECT_URI,
					OAuth2EndpointUtils.ACCESS_TOKEN_REQUEST_ERROR_URI);
		}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 74 

              		// Required only if the "redirect_uri" parameter was included in the authorization request
		String redirectUri = parameters.getFirst(OAuth2ParameterNames.REDIRECT_URI);
		if (StringUtils.hasText(redirectUri) &&
				parameters.get(OAuth2ParameterNames.REDIRECT_URI).size() != 1) {
			OAuth2EndpointUtils.throwError(
					OAuth2ErrorCodes.INVALID_REQUEST,
					OAuth2ParameterNames.REDIRECT_URI,
					OAuth2EndpointUtils.ACCESS_TOKEN_REQUEST_ERROR_URI);
		}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 82 

              		}

		Map<String, Object> additionalParameters = new HashMap<>();
		parameters.forEach((key, value) -> {
			if (!key.equals(OAuth2ParameterNames.GRANT_TYPE) &&
					!key.equals(OAuth2ParameterNames.CLIENT_ID) &&
					!key.equals(OAuth2ParameterNames.CODE) &&
					!key.equals(OAuth2ParameterNames.REDIRECT_URI)) {
				additionalParameters.put(key, value.get(0));

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/ClientSecretPostAuthenticationConverter.java
10 issues
Potential violation of Law of Demeter (object not created locally)
Design

Line: 55 

              		MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);

		// client_id (REQUIRED)
		String clientId = parameters.getFirst(OAuth2ParameterNames.CLIENT_ID);
		if (!StringUtils.hasText(clientId)) {
			return null;
		}

		if (parameters.get(OAuth2ParameterNames.CLIENT_ID).size() != 1) {

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 60 

              			return null;
		}

		if (parameters.get(OAuth2ParameterNames.CLIENT_ID).size() != 1) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
		}

		// client_secret (REQUIRED)
		String clientSecret = parameters.getFirst(OAuth2ParameterNames.CLIENT_SECRET);

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 60 

              			return null;
		}

		if (parameters.get(OAuth2ParameterNames.CLIENT_ID).size() != 1) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
		}

		// client_secret (REQUIRED)
		String clientSecret = parameters.getFirst(OAuth2ParameterNames.CLIENT_SECRET);

Reported by PMD.

Avoid using Literals in Conditional Statements
Error

Line: 60 

              			return null;
		}

		if (parameters.get(OAuth2ParameterNames.CLIENT_ID).size() != 1) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
		}

		// client_secret (REQUIRED)
		String clientSecret = parameters.getFirst(OAuth2ParameterNames.CLIENT_SECRET);

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 65 

              		}

		// client_secret (REQUIRED)
		String clientSecret = parameters.getFirst(OAuth2ParameterNames.CLIENT_SECRET);
		if (!StringUtils.hasText(clientSecret)) {
			return null;
		}

		if (parameters.get(OAuth2ParameterNames.CLIENT_SECRET).size() != 1) {

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 70 

              			return null;
		}

		if (parameters.get(OAuth2ParameterNames.CLIENT_SECRET).size() != 1) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
		}

		return new OAuth2ClientAuthenticationToken(clientId, ClientAuthenticationMethod.CLIENT_SECRET_POST, clientSecret,
				extractAdditionalParameters(request));

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 70 

              			return null;
		}

		if (parameters.get(OAuth2ParameterNames.CLIENT_SECRET).size() != 1) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
		}

		return new OAuth2ClientAuthenticationToken(clientId, ClientAuthenticationMethod.CLIENT_SECRET_POST, clientSecret,
				extractAdditionalParameters(request));

Reported by PMD.

Avoid using Literals in Conditional Statements
Error

Line: 70 

              			return null;
		}

		if (parameters.get(OAuth2ParameterNames.CLIENT_SECRET).size() != 1) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
		}

		return new OAuth2ClientAuthenticationToken(clientId, ClientAuthenticationMethod.CLIENT_SECRET_POST, clientSecret,
				extractAdditionalParameters(request));

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 82 

              		Map<String, Object> additionalParameters = Collections.emptyMap();
		if (OAuth2EndpointUtils.matchesPkceTokenRequest(request)) {
			// Confidential clients can also leverage PKCE
			additionalParameters = new HashMap<>(OAuth2EndpointUtils.getParameters(request).toSingleValueMap());
			additionalParameters.remove(OAuth2ParameterNames.CLIENT_ID);
			additionalParameters.remove(OAuth2ParameterNames.CLIENT_SECRET);
		}
		return additionalParameters;
	}

Reported by PMD.

Found 'DD'-anomaly for variable 'additionalParameters' (lines '79'-'82').
Error

Line: 79 

              	}

	private static Map<String, Object> extractAdditionalParameters(HttpServletRequest request) {
		Map<String, Object> additionalParameters = Collections.emptyMap();
		if (OAuth2EndpointUtils.matchesPkceTokenRequest(request)) {
			// Confidential clients can also leverage PKCE
			additionalParameters = new HashMap<>(OAuth2EndpointUtils.getParameters(request).toSingleValueMap());
			additionalParameters.remove(OAuth2ParameterNames.CLIENT_ID);
			additionalParameters.remove(OAuth2ParameterNames.CLIENT_SECRET);

Reported by PMD.

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/jwt/TestJwtClaimsSets.java
9 issues
Potential violation of Law of Demeter (object not created locally)
Design

Line: 33 

              	public static JwtClaimsSet.Builder jwtClaimsSet() {
		String issuer = "https://provider.com";
		Instant issuedAt = Instant.now();
		Instant expiresAt = issuedAt.plus(1, ChronoUnit.HOURS);

		// @formatter:off
		return JwtClaimsSet.builder()
				.issuer(issuer)
				.subject("subject")

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 36 

              		Instant expiresAt = issuedAt.plus(1, ChronoUnit.HOURS);

		// @formatter:off
		return JwtClaimsSet.builder()
				.issuer(issuer)
				.subject("subject")
				.audience(Collections.singletonList("client-1"))
				.issuedAt(issuedAt)
				.notBefore(issuedAt)

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 36 

              		Instant expiresAt = issuedAt.plus(1, ChronoUnit.HOURS);

		// @formatter:off
		return JwtClaimsSet.builder()
				.issuer(issuer)
				.subject("subject")
				.audience(Collections.singletonList("client-1"))
				.issuedAt(issuedAt)
				.notBefore(issuedAt)

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 36 

              		Instant expiresAt = issuedAt.plus(1, ChronoUnit.HOURS);

		// @formatter:off
		return JwtClaimsSet.builder()
				.issuer(issuer)
				.subject("subject")
				.audience(Collections.singletonList("client-1"))
				.issuedAt(issuedAt)
				.notBefore(issuedAt)

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 36 

              		Instant expiresAt = issuedAt.plus(1, ChronoUnit.HOURS);

		// @formatter:off
		return JwtClaimsSet.builder()
				.issuer(issuer)
				.subject("subject")
				.audience(Collections.singletonList("client-1"))
				.issuedAt(issuedAt)
				.notBefore(issuedAt)

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 36 

              		Instant expiresAt = issuedAt.plus(1, ChronoUnit.HOURS);

		// @formatter:off
		return JwtClaimsSet.builder()
				.issuer(issuer)
				.subject("subject")
				.audience(Collections.singletonList("client-1"))
				.issuedAt(issuedAt)
				.notBefore(issuedAt)

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 36 

              		Instant expiresAt = issuedAt.plus(1, ChronoUnit.HOURS);

		// @formatter:off
		return JwtClaimsSet.builder()
				.issuer(issuer)
				.subject("subject")
				.audience(Collections.singletonList("client-1"))
				.issuedAt(issuedAt)
				.notBefore(issuedAt)

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 36 

              		Instant expiresAt = issuedAt.plus(1, ChronoUnit.HOURS);

		// @formatter:off
		return JwtClaimsSet.builder()
				.issuer(issuer)
				.subject("subject")
				.audience(Collections.singletonList("client-1"))
				.issuedAt(issuedAt)
				.notBefore(issuedAt)

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 36 

              		Instant expiresAt = issuedAt.plus(1, ChronoUnit.HOURS);

		// @formatter:off
		return JwtClaimsSet.builder()
				.issuer(issuer)
				.subject("subject")
				.audience(Collections.singletonList("client-1"))
				.issuedAt(issuedAt)
				.notBefore(issuedAt)

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/JdbcOAuth2AuthorizationConsentService.java
9 issues
Potential violation of Law of Demeter (object not created locally)
Design

Line: 122 

              
	private void updateAuthorizationConsent(OAuth2AuthorizationConsent authorizationConsent) {
		List<SqlParameterValue> parameters = this.authorizationConsentParametersMapper.apply(authorizationConsent);
		SqlParameterValue registeredClientId = parameters.remove(0);
		SqlParameterValue principalName = parameters.remove(0);
		parameters.add(registeredClientId);
		parameters.add(principalName);
		PreparedStatementSetter pss = new ArgumentPreparedStatementSetter(parameters.toArray());
		this.jdbcOperations.update(UPDATE_AUTHORIZATION_CONSENT_SQL, pss);

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 123 

              	private void updateAuthorizationConsent(OAuth2AuthorizationConsent authorizationConsent) {
		List<SqlParameterValue> parameters = this.authorizationConsentParametersMapper.apply(authorizationConsent);
		SqlParameterValue registeredClientId = parameters.remove(0);
		SqlParameterValue principalName = parameters.remove(0);
		parameters.add(registeredClientId);
		parameters.add(principalName);
		PreparedStatementSetter pss = new ArgumentPreparedStatementSetter(parameters.toArray());
		this.jdbcOperations.update(UPDATE_AUTHORIZATION_CONSENT_SQL, pss);
	}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 124 

              		List<SqlParameterValue> parameters = this.authorizationConsentParametersMapper.apply(authorizationConsent);
		SqlParameterValue registeredClientId = parameters.remove(0);
		SqlParameterValue principalName = parameters.remove(0);
		parameters.add(registeredClientId);
		parameters.add(principalName);
		PreparedStatementSetter pss = new ArgumentPreparedStatementSetter(parameters.toArray());
		this.jdbcOperations.update(UPDATE_AUTHORIZATION_CONSENT_SQL, pss);
	}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 125 

              		SqlParameterValue registeredClientId = parameters.remove(0);
		SqlParameterValue principalName = parameters.remove(0);
		parameters.add(registeredClientId);
		parameters.add(principalName);
		PreparedStatementSetter pss = new ArgumentPreparedStatementSetter(parameters.toArray());
		this.jdbcOperations.update(UPDATE_AUTHORIZATION_CONSENT_SQL, pss);
	}

	private void insertAuthorizationConsent(OAuth2AuthorizationConsent authorizationConsent) {

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 126 

              		SqlParameterValue principalName = parameters.remove(0);
		parameters.add(registeredClientId);
		parameters.add(principalName);
		PreparedStatementSetter pss = new ArgumentPreparedStatementSetter(parameters.toArray());
		this.jdbcOperations.update(UPDATE_AUTHORIZATION_CONSENT_SQL, pss);
	}

	private void insertAuthorizationConsent(OAuth2AuthorizationConsent authorizationConsent) {
		List<SqlParameterValue> parameters = this.authorizationConsentParametersMapper.apply(authorizationConsent);

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 132 

              
	private void insertAuthorizationConsent(OAuth2AuthorizationConsent authorizationConsent) {
		List<SqlParameterValue> parameters = this.authorizationConsentParametersMapper.apply(authorizationConsent);
		PreparedStatementSetter pss = new ArgumentPreparedStatementSetter(parameters.toArray());
		this.jdbcOperations.update(SAVE_AUTHORIZATION_CONSENT_SQL, pss);
	}

	@Override
	public void remove(OAuth2AuthorizationConsent authorizationConsent) {

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 158 

              		PreparedStatementSetter pss = new ArgumentPreparedStatementSetter(parameters);
		List<OAuth2AuthorizationConsent> result = this.jdbcOperations.query(LOAD_AUTHORIZATION_CONSENT_SQL, pss,
				this.authorizationConsentRowMapper);
		return !result.isEmpty() ? result.get(0) : null;
	}

	/**
	 * Sets the {@link RowMapper} used for mapping the current row in
	 * {@code java.sql.ResultSet} to {@link OAuth2AuthorizationConsent}. The default is

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 158 

              		PreparedStatementSetter pss = new ArgumentPreparedStatementSetter(parameters);
		List<OAuth2AuthorizationConsent> result = this.jdbcOperations.query(LOAD_AUTHORIZATION_CONSENT_SQL, pss,
				this.authorizationConsentRowMapper);
		return !result.isEmpty() ? result.get(0) : null;
	}

	/**
	 * Sets the {@link RowMapper} used for mapping the current row in
	 * {@code java.sql.ResultSet} to {@link OAuth2AuthorizationConsent}. The default is

Reported by PMD.

Avoid instantiating new objects inside loops
Performance

Line: 227 

              			String authorizationConsentAuthorities = rs.getString("authorities");
			if (authorizationConsentAuthorities != null) {
				for (String authority : StringUtils.commaDelimitedListToSet(authorizationConsentAuthorities)) {
					builder.authority(new SimpleGrantedAuthority(authority));
				}
			}
			return builder.build();
		}

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2ClientCredentialsAuthenticationConverter.java
8 issues
Potential violation of Law of Demeter (static property access)
Design

Line: 55 

              	public Authentication convert(HttpServletRequest request) {
		// grant_type (REQUIRED)
		String grantType = request.getParameter(OAuth2ParameterNames.GRANT_TYPE);
		if (!AuthorizationGrantType.CLIENT_CREDENTIALS.getValue().equals(grantType)) {
			return null;
		}

		Authentication clientPrincipal = SecurityContextHolder.getContext().getAuthentication();

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 55 

              	public Authentication convert(HttpServletRequest request) {
		// grant_type (REQUIRED)
		String grantType = request.getParameter(OAuth2ParameterNames.GRANT_TYPE);
		if (!AuthorizationGrantType.CLIENT_CREDENTIALS.getValue().equals(grantType)) {
			return null;
		}

		Authentication clientPrincipal = SecurityContextHolder.getContext().getAuthentication();

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 59 

              			return null;
		}

		Authentication clientPrincipal = SecurityContextHolder.getContext().getAuthentication();

		MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);

		// scope (OPTIONAL)
		String scope = parameters.getFirst(OAuth2ParameterNames.SCOPE);

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 64 

              		MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);

		// scope (OPTIONAL)
		String scope = parameters.getFirst(OAuth2ParameterNames.SCOPE);
		if (StringUtils.hasText(scope) &&
				parameters.get(OAuth2ParameterNames.SCOPE).size() != 1) {
			OAuth2EndpointUtils.throwError(
					OAuth2ErrorCodes.INVALID_REQUEST,
					OAuth2ParameterNames.SCOPE,

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 66 

              		// scope (OPTIONAL)
		String scope = parameters.getFirst(OAuth2ParameterNames.SCOPE);
		if (StringUtils.hasText(scope) &&
				parameters.get(OAuth2ParameterNames.SCOPE).size() != 1) {
			OAuth2EndpointUtils.throwError(
					OAuth2ErrorCodes.INVALID_REQUEST,
					OAuth2ParameterNames.SCOPE,
					OAuth2EndpointUtils.ACCESS_TOKEN_REQUEST_ERROR_URI);
		}

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 66 

              		// scope (OPTIONAL)
		String scope = parameters.getFirst(OAuth2ParameterNames.SCOPE);
		if (StringUtils.hasText(scope) &&
				parameters.get(OAuth2ParameterNames.SCOPE).size() != 1) {
			OAuth2EndpointUtils.throwError(
					OAuth2ErrorCodes.INVALID_REQUEST,
					OAuth2ParameterNames.SCOPE,
					OAuth2EndpointUtils.ACCESS_TOKEN_REQUEST_ERROR_URI);
		}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 79 

              		}

		Map<String, Object> additionalParameters = new HashMap<>();
		parameters.forEach((key, value) -> {
			if (!key.equals(OAuth2ParameterNames.GRANT_TYPE) &&
					!key.equals(OAuth2ParameterNames.SCOPE)) {
				additionalParameters.put(key, value.get(0));
			}
		});

Reported by PMD.

Found 'DD'-anomaly for variable 'requestedScopes' (lines '72'-'74').
Error

Line: 72 

              					OAuth2ParameterNames.SCOPE,
					OAuth2EndpointUtils.ACCESS_TOKEN_REQUEST_ERROR_URI);
		}
		Set<String> requestedScopes = null;
		if (StringUtils.hasText(scope)) {
			requestedScopes = new HashSet<>(
					Arrays.asList(StringUtils.delimitedListToStringArray(scope, " ")));
		}

Reported by PMD.

samples/boot/oauth2-integration/authorizationserver-custom-consent-page/src/main/java/sample/jose/Jwks.java
8 issues
Potential violation of Law of Demeter (object not created locally)
Design

Line: 42 

              
	public static RSAKey generateRsa() {
		KeyPair keyPair = KeyGeneratorUtils.generateRsaKey();
		RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
		RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
		// @formatter:off
		return new RSAKey.Builder(publicKey)
				.privateKey(privateKey)
				.keyID(UUID.randomUUID().toString())

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 43 

              	public static RSAKey generateRsa() {
		KeyPair keyPair = KeyGeneratorUtils.generateRsaKey();
		RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
		RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
		// @formatter:off
		return new RSAKey.Builder(publicKey)
				.privateKey(privateKey)
				.keyID(UUID.randomUUID().toString())
				.build();

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 47 

              		// @formatter:off
		return new RSAKey.Builder(publicKey)
				.privateKey(privateKey)
				.keyID(UUID.randomUUID().toString())
				.build();
		// @formatter:on
	}

	public static ECKey generateEc() {

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 54 

              
	public static ECKey generateEc() {
		KeyPair keyPair = KeyGeneratorUtils.generateEcKey();
		ECPublicKey publicKey = (ECPublicKey) keyPair.getPublic();
		ECPrivateKey privateKey = (ECPrivateKey) keyPair.getPrivate();
		Curve curve = Curve.forECParameterSpec(publicKey.getParams());
		// @formatter:off
		return new ECKey.Builder(curve, publicKey)
				.privateKey(privateKey)

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 55 

              	public static ECKey generateEc() {
		KeyPair keyPair = KeyGeneratorUtils.generateEcKey();
		ECPublicKey publicKey = (ECPublicKey) keyPair.getPublic();
		ECPrivateKey privateKey = (ECPrivateKey) keyPair.getPrivate();
		Curve curve = Curve.forECParameterSpec(publicKey.getParams());
		// @formatter:off
		return new ECKey.Builder(curve, publicKey)
				.privateKey(privateKey)
				.keyID(UUID.randomUUID().toString())

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 56 

              		KeyPair keyPair = KeyGeneratorUtils.generateEcKey();
		ECPublicKey publicKey = (ECPublicKey) keyPair.getPublic();
		ECPrivateKey privateKey = (ECPrivateKey) keyPair.getPrivate();
		Curve curve = Curve.forECParameterSpec(publicKey.getParams());
		// @formatter:off
		return new ECKey.Builder(curve, publicKey)
				.privateKey(privateKey)
				.keyID(UUID.randomUUID().toString())
				.build();

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 60 

              		// @formatter:off
		return new ECKey.Builder(curve, publicKey)
				.privateKey(privateKey)
				.keyID(UUID.randomUUID().toString())
				.build();
		// @formatter:on
	}

	public static OctetSequenceKey generateSecret() {

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 69 

              		SecretKey secretKey = KeyGeneratorUtils.generateSecretKey();
		// @formatter:off
		return new OctetSequenceKey.Builder(secretKey)
				.keyID(UUID.randomUUID().toString())
				.build();
		// @formatter:on
	}
}

Reported by PMD.

oauth2-authorization-server/src/test/java/org/springframework/security/config/test/SpringTestContext.java
8 issues
Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 55 

               * @since 5.0
 */
public class SpringTestContext implements Closeable {
	private Object test;

	private ConfigurableWebApplicationContext context;

	private List<Filter> filters = new ArrayList<>();

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 57 

              public class SpringTestContext implements Closeable {
	private Object test;

	private ConfigurableWebApplicationContext context;

	private List<Filter> filters = new ArrayList<>();

	public void setTest(Object test) {
		this.test = test;

Reported by PMD.

Field context has the same name as a method
Error

Line: 57 

              public class SpringTestContext implements Closeable {
	private Object test;

	private ConfigurableWebApplicationContext context;

	private List<Filter> filters = new ArrayList<>();

	public void setTest(Object test) {
		this.test = test;

Reported by PMD.

Private field 'filters' could be made final; it is only initialized in the declaration or constructor.
Design

Line: 59 

              
	private ConfigurableWebApplicationContext context;

	private List<Filter> filters = new ArrayList<>();

	public void setTest(Object test) {
		this.test = test;
	}

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 59 

              
	private ConfigurableWebApplicationContext context;

	private List<Filter> filters = new ArrayList<>();

	public void setTest(Object test) {
		this.test = test;
	}

Reported by PMD.

Avoid catching generic exceptions such as NullPointerException, RuntimeException, Exception in try-catch block
Design

Line: 69 

              	public void close() {
		try {
			this.context.close();
		} catch(Exception e) {}
	}

	public SpringTestContext context(ConfigurableWebApplicationContext context) {
		this.context = context;
		return this;

Reported by PMD.

Avoid empty catch blocks
Error

Line: 69 

              	public void close() {
		try {
			this.context.close();
		} catch(Exception e) {}
	}

	public SpringTestContext context(ConfigurableWebApplicationContext context) {
		this.context = context;
		return this;

Reported by PMD.

JUnit 4 tests that execute tests should use the @Test annotation, JUnit 5 tests should use @Test, @RepeatedTest, @TestFactory, @TestTemplate or @ParameterizedTest
Design

Line: 84 

              		return this;
	}

	public SpringTestContext testConfigLocations(String... configLocations) {
		GenericXmlWebContextLoader loader = new GenericXmlWebContextLoader();
		String[] locations = loader.processLocations(this.test.getClass(),
			configLocations);
		return configLocations(locations);
	}

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/PublicClientAuthenticationConverter.java
8 issues
Potential violation of Law of Demeter (object not created locally)
Design

Line: 58 

              		MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);

		// client_id (REQUIRED for public clients)
		String clientId = parameters.getFirst(OAuth2ParameterNames.CLIENT_ID);
		if (!StringUtils.hasText(clientId) ||
				parameters.get(OAuth2ParameterNames.CLIENT_ID).size() != 1) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
		}

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 60 

              		// client_id (REQUIRED for public clients)
		String clientId = parameters.getFirst(OAuth2ParameterNames.CLIENT_ID);
		if (!StringUtils.hasText(clientId) ||
				parameters.get(OAuth2ParameterNames.CLIENT_ID).size() != 1) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
		}

		// code_verifier (REQUIRED)
		if (parameters.get(PkceParameterNames.CODE_VERIFIER).size() != 1) {

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 60 

              		// client_id (REQUIRED for public clients)
		String clientId = parameters.getFirst(OAuth2ParameterNames.CLIENT_ID);
		if (!StringUtils.hasText(clientId) ||
				parameters.get(OAuth2ParameterNames.CLIENT_ID).size() != 1) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
		}

		// code_verifier (REQUIRED)
		if (parameters.get(PkceParameterNames.CODE_VERIFIER).size() != 1) {

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 65 

              		}

		// code_verifier (REQUIRED)
		if (parameters.get(PkceParameterNames.CODE_VERIFIER).size() != 1) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
		}

		parameters.remove(OAuth2ParameterNames.CLIENT_ID);

Reported by PMD.

Avoid using Literals in Conditional Statements
Error

Line: 65 

              		}

		// code_verifier (REQUIRED)
		if (parameters.get(PkceParameterNames.CODE_VERIFIER).size() != 1) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
		}

		parameters.remove(OAuth2ParameterNames.CLIENT_ID);

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 65 

              		}

		// code_verifier (REQUIRED)
		if (parameters.get(PkceParameterNames.CODE_VERIFIER).size() != 1) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
		}

		parameters.remove(OAuth2ParameterNames.CLIENT_ID);

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 69 

              			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
		}

		parameters.remove(OAuth2ParameterNames.CLIENT_ID);

		return new OAuth2ClientAuthenticationToken(clientId, ClientAuthenticationMethod.NONE, null,
				new HashMap<>(parameters.toSingleValueMap()));
	}
}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 72 

              		parameters.remove(OAuth2ParameterNames.CLIENT_ID);

		return new OAuth2ClientAuthenticationToken(clientId, ClientAuthenticationMethod.NONE, null,
				new HashMap<>(parameters.toSingleValueMap()));
	}
}

Reported by PMD.

samples/boot/oauth2-integration/authorizationserver/src/main/java/sample/jose/Jwks.java
8 issues
Potential violation of Law of Demeter (object not created locally)
Design

Line: 43 

              
	public static RSAKey generateRsa() {
		KeyPair keyPair = KeyGeneratorUtils.generateRsaKey();
		RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
		RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
		// @formatter:off
		return new RSAKey.Builder(publicKey)
				.privateKey(privateKey)
				.keyID(UUID.randomUUID().toString())

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 44 

              	public static RSAKey generateRsa() {
		KeyPair keyPair = KeyGeneratorUtils.generateRsaKey();
		RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
		RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();
		// @formatter:off
		return new RSAKey.Builder(publicKey)
				.privateKey(privateKey)
				.keyID(UUID.randomUUID().toString())
				.build();

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 48 

              		// @formatter:off
		return new RSAKey.Builder(publicKey)
				.privateKey(privateKey)
				.keyID(UUID.randomUUID().toString())
				.build();
		// @formatter:on
	}

	public static ECKey generateEc() {

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 55 

              
	public static ECKey generateEc() {
		KeyPair keyPair = KeyGeneratorUtils.generateEcKey();
		ECPublicKey publicKey = (ECPublicKey) keyPair.getPublic();
		ECPrivateKey privateKey = (ECPrivateKey) keyPair.getPrivate();
		Curve curve = Curve.forECParameterSpec(publicKey.getParams());
		// @formatter:off
		return new ECKey.Builder(curve, publicKey)
				.privateKey(privateKey)

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 56 

              	public static ECKey generateEc() {
		KeyPair keyPair = KeyGeneratorUtils.generateEcKey();
		ECPublicKey publicKey = (ECPublicKey) keyPair.getPublic();
		ECPrivateKey privateKey = (ECPrivateKey) keyPair.getPrivate();
		Curve curve = Curve.forECParameterSpec(publicKey.getParams());
		// @formatter:off
		return new ECKey.Builder(curve, publicKey)
				.privateKey(privateKey)
				.keyID(UUID.randomUUID().toString())

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 57 

              		KeyPair keyPair = KeyGeneratorUtils.generateEcKey();
		ECPublicKey publicKey = (ECPublicKey) keyPair.getPublic();
		ECPrivateKey privateKey = (ECPrivateKey) keyPair.getPrivate();
		Curve curve = Curve.forECParameterSpec(publicKey.getParams());
		// @formatter:off
		return new ECKey.Builder(curve, publicKey)
				.privateKey(privateKey)
				.keyID(UUID.randomUUID().toString())
				.build();

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 61 

              		// @formatter:off
		return new ECKey.Builder(curve, publicKey)
				.privateKey(privateKey)
				.keyID(UUID.randomUUID().toString())
				.build();
		// @formatter:on
	}

	public static OctetSequenceKey generateSecret() {

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 70 

              		SecretKey secretKey = KeyGeneratorUtils.generateSecretKey();
		// @formatter:off
		return new OctetSequenceKey.Builder(secretKey)
				.keyID(UUID.randomUUID().toString())
				.build();
		// @formatter:on
	}
}

Reported by PMD.