The following issues were found

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/NimbusJwkSetEndpointFilter.java
5 issues
Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 54 

              	 */
	private static final String DEFAULT_JWK_SET_ENDPOINT_URI = "/oauth2/jwks";

	private final JWKSource<SecurityContext> jwkSource;
	private final JWKSelector jwkSelector;
	private final RequestMatcher requestMatcher;

	/**
	 * Constructs a {@code NimbusJwkSetEndpointFilter} using the provided parameters.

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 55 

              	private static final String DEFAULT_JWK_SET_ENDPOINT_URI = "/oauth2/jwks";

	private final JWKSource<SecurityContext> jwkSource;
	private final JWKSelector jwkSelector;
	private final RequestMatcher requestMatcher;

	/**
	 * Constructs a {@code NimbusJwkSetEndpointFilter} using the provided parameters.
	 * @param jwkSource the {@code com.nimbusds.jose.jwk.source.JWKSource}

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 56 

              
	private final JWKSource<SecurityContext> jwkSource;
	private final JWKSelector jwkSelector;
	private final RequestMatcher requestMatcher;

	/**
	 * Constructs a {@code NimbusJwkSetEndpointFilter} using the provided parameters.
	 * @param jwkSource the {@code com.nimbusds.jose.jwk.source.JWKSource}
	 */

Reported by PMD.

Avoid catching generic exceptions such as NullPointerException, RuntimeException, Exception in try-catch block
Design

Line: 93 

              		try {
			jwkSet = new JWKSet(this.jwkSource.get(this.jwkSelector, null));
		}
		catch (Exception ex) {
			throw new IllegalStateException("Failed to select the JWK(s) -> " + ex.getMessage(), ex);
		}

		response.setContentType(MediaType.APPLICATION_JSON_VALUE);
		try (Writer writer = response.getWriter()) {

Reported by PMD.

Found 'DU'-anomaly for variable 'jwkSet' (lines '91'-'101').
Error

Line: 91 

              
		JWKSet jwkSet;
		try {
			jwkSet = new JWKSet(this.jwkSource.get(this.jwkSelector, null));
		}
		catch (Exception ex) {
			throw new IllegalStateException("Failed to select the JWK(s) -> " + ex.getMessage(), ex);
		}

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/jackson2/JsonNodeUtils.java
5 issues
This abstract class does not have any abstract methods
Design

Line: 36 

               * @author Joe Grandja
 * @since 5.3
 */
abstract class JsonNodeUtils {

	static final TypeReference<Set<String>> STRING_SET = new TypeReference<Set<String>>() {
	};

	static final TypeReference<Map<String, Object>> STRING_OBJECT_MAP = new TypeReference<Map<String, Object>>() {

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 49 

              			return null;
		}
		JsonNode value = jsonNode.findValue(fieldName);
		return (value != null && value.isTextual()) ? value.asText() : null;
	}

	static <T> T findValue(JsonNode jsonNode, String fieldName, TypeReference<T> valueTypeReference,
			ObjectMapper mapper) {
		if (jsonNode == null) {

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 49 

              			return null;
		}
		JsonNode value = jsonNode.findValue(fieldName);
		return (value != null && value.isTextual()) ? value.asText() : null;
	}

	static <T> T findValue(JsonNode jsonNode, String fieldName, TypeReference<T> valueTypeReference,
			ObjectMapper mapper) {
		if (jsonNode == null) {

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 58 

              			return null;
		}
		JsonNode value = jsonNode.findValue(fieldName);
		return (value != null && value.isContainerNode()) ? mapper.convertValue(value, valueTypeReference) : null;
	}

	static JsonNode findObjectNode(JsonNode jsonNode, String fieldName) {
		if (jsonNode == null) {
			return null;

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 66 

              			return null;
		}
		JsonNode value = jsonNode.findValue(fieldName);
		return (value != null && value.isObject()) ? value : null;
	}

}

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/config/annotation/web/configuration/OAuth2AuthorizationServerConfiguration.java
5 issues
A method/constructor should not explicitly throw java.lang.Exception
Design

Line: 53 

              
	@Bean
	@Order(Ordered.HIGHEST_PRECEDENCE)
	public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
		applyDefaultSecurity(http);
		return http.build();
	}

	// @formatter:off

Reported by PMD.

A method/constructor should not explicitly throw java.lang.Exception
Design

Line: 59 

              	}

	// @formatter:off
	public static void applyDefaultSecurity(HttpSecurity http) throws Exception {
		OAuth2AuthorizationServerConfigurer<HttpSecurity> authorizationServerConfigurer =
				new OAuth2AuthorizationServerConfigurer<>();
		RequestMatcher endpointsMatcher = authorizationServerConfigurer
				.getEndpointsMatcher();

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 65 

              		RequestMatcher endpointsMatcher = authorizationServerConfigurer
				.getEndpointsMatcher();

		http
			.requestMatcher(endpointsMatcher)
			.authorizeRequests(authorizeRequests ->
				authorizeRequests.anyRequest().authenticated()
			)
			.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 65 

              		RequestMatcher endpointsMatcher = authorizationServerConfigurer
				.getEndpointsMatcher();

		http
			.requestMatcher(endpointsMatcher)
			.authorizeRequests(authorizeRequests ->
				authorizeRequests.anyRequest().authenticated()
			)
			.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 65 

              		RequestMatcher endpointsMatcher = authorizationServerConfigurer
				.getEndpointsMatcher();

		http
			.requestMatcher(endpointsMatcher)
			.authorizeRequests(authorizeRequests ->
				authorizeRequests.anyRequest().authenticated()
			)
			.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/OAuth2TokenIntrospection.java
5 issues
Potential violation of Law of Demeter (method chain calls)
Design

Line: 86 

              	 */
	public static Builder withClaims(Map<String, Object> claims) {
		Assert.notEmpty(claims, "claims cannot be empty");
		return builder().claims(c -> c.putAll(claims));
	}

	/**
	 * A builder for {@link OAuth2TokenIntrospection}.
	 */

Reported by PMD.

This class has too many methods, consider refactoring it.
Design

Line: 92 

              	/**
	 * A builder for {@link OAuth2TokenIntrospection}.
	 */
	public static class Builder {
		private final Map<String, Object> claims = new LinkedHashMap<>();

		private Builder(boolean active) {
			active(active);
		}

Reported by PMD.

Field claims has the same name as a method
Error

Line: 93 

              	 * A builder for {@link OAuth2TokenIntrospection}.
	 */
	public static class Builder {
		private final Map<String, Object> claims = new LinkedHashMap<>();

		private Builder(boolean active) {
			active(active);
		}

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 93 

              	 * A builder for {@link OAuth2TokenIntrospection}.
	 */
	public static class Builder {
		private final Map<String, Object> claims = new LinkedHashMap<>();

		private Builder(boolean active) {
			active(active);
		}

Reported by PMD.

Avoid catching generic exceptions such as NullPointerException, RuntimeException, Exception in try-catch block
Design

Line: 331 

              
			try {
				new URI(url.toString()).toURL();
			} catch (Exception ex) {
				throw new IllegalArgumentException(errorMessage, ex);
			}
		}
	}
}

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OidcConfigurer.java
5 issues
Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 42 

               * @see OidcProviderConfigurationEndpointFilter
 */
public final class OidcConfigurer extends AbstractOAuth2Configurer {
	private OidcClientRegistrationEndpointConfigurer clientRegistrationEndpointConfigurer;
	private RequestMatcher requestMatcher;

	/**
	 * Restrict for internal use only.
	 */

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 43 

               */
public final class OidcConfigurer extends AbstractOAuth2Configurer {
	private OidcClientRegistrationEndpointConfigurer clientRegistrationEndpointConfigurer;
	private RequestMatcher requestMatcher;

	/**
	 * Restrict for internal use only.
	 */
	OidcConfigurer(ObjectPostProcessor<Object> objectPostProcessor) {

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 74 

              
		List<RequestMatcher> requestMatchers = new ArrayList<>();
		ProviderSettings providerSettings = OAuth2ConfigurerUtils.getProviderSettings(builder);
		if (providerSettings.getIssuer() != null) {
			requestMatchers.add(new AntPathRequestMatcher(
					"/.well-known/openid-configuration", HttpMethod.GET.name()));
		}
		if (this.clientRegistrationEndpointConfigurer != null) {
			requestMatchers.add(this.clientRegistrationEndpointConfigurer.getRequestMatcher());

Reported by PMD.

Potential violation of Law of Demeter (static property access)
Design

Line: 76 

              		ProviderSettings providerSettings = OAuth2ConfigurerUtils.getProviderSettings(builder);
		if (providerSettings.getIssuer() != null) {
			requestMatchers.add(new AntPathRequestMatcher(
					"/.well-known/openid-configuration", HttpMethod.GET.name()));
		}
		if (this.clientRegistrationEndpointConfigurer != null) {
			requestMatchers.add(this.clientRegistrationEndpointConfigurer.getRequestMatcher());
		}
		this.requestMatcher = !requestMatchers.isEmpty() ? new OrRequestMatcher(requestMatchers) : request -> false;

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 91 

              		}

		ProviderSettings providerSettings = OAuth2ConfigurerUtils.getProviderSettings(builder);
		if (providerSettings.getIssuer() != null) {
			OidcProviderConfigurationEndpointFilter oidcProviderConfigurationEndpointFilter =
					new OidcProviderConfigurationEndpointFilter(providerSettings);
			builder.addFilterBefore(postProcess(oidcProviderConfigurationEndpointFilter), AbstractPreAuthenticatedProcessingFilter.class);
		}
	}

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcAuthenticationProviderUtils.java
4 issues
Potential violation of Law of Demeter (method chain calls)
Design

Line: 39 

              			OAuth2Authorization authorization, T token) {

		// @formatter:off
		OAuth2Authorization.Builder authorizationBuilder = OAuth2Authorization.from(authorization)
				.token(token,
						(metadata) ->
								metadata.put(OAuth2Authorization.Token.INVALIDATED_METADATA_NAME, true));

		if (OAuth2RefreshToken.class.isAssignableFrom(token.getClass())) {

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 46 

              
		if (OAuth2RefreshToken.class.isAssignableFrom(token.getClass())) {
			authorizationBuilder.token(
					authorization.getAccessToken().getToken(),
					(metadata) ->
							metadata.put(OAuth2Authorization.Token.INVALIDATED_METADATA_NAME, true));

			OAuth2Authorization.Token<OAuth2AuthorizationCode> authorizationCode =
					authorization.getToken(OAuth2AuthorizationCode.class);

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 52 

              
			OAuth2Authorization.Token<OAuth2AuthorizationCode> authorizationCode =
					authorization.getToken(OAuth2AuthorizationCode.class);
			if (authorizationCode != null && !authorizationCode.isInvalidated()) {
				authorizationBuilder.token(
						authorizationCode.getToken(),
						(metadata) ->
								metadata.put(OAuth2Authorization.Token.INVALIDATED_METADATA_NAME, true));
			}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 54 

              					authorization.getToken(OAuth2AuthorizationCode.class);
			if (authorizationCode != null && !authorizationCode.isInvalidated()) {
				authorizationBuilder.token(
						authorizationCode.getToken(),
						(metadata) ->
								metadata.put(OAuth2Authorization.Token.INVALIDATED_METADATA_NAME, true));
			}
		}
		// @formatter:on

Reported by PMD.

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/jose/TestKeys.java
4 issues
Potential violation of Law of Demeter (object not created locally)
Design

Line: 142 

              		KeyPair keyPair;
		try {
			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");
			keyPairGenerator.initialize(ecParameterSpec);
			keyPair = keyPairGenerator.generateKeyPair();
		}
		catch (Exception ex) {
			throw new IllegalStateException(ex);
		}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 143 

              		try {
			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");
			keyPairGenerator.initialize(ecParameterSpec);
			keyPair = keyPairGenerator.generateKeyPair();
		}
		catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return keyPair;

Reported by PMD.

Avoid catching generic exceptions such as NullPointerException, RuntimeException, Exception in try-catch block
Design

Line: 145 

              			keyPairGenerator.initialize(ecParameterSpec);
			keyPair = keyPairGenerator.generateKeyPair();
		}
		catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return keyPair;
	}

Reported by PMD.

Found 'DU'-anomaly for variable 'keyPair' (lines '143'-'149').
Error

Line: 143 

              		try {
			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");
			keyPairGenerator.initialize(ecParameterSpec);
			keyPair = keyPairGenerator.generateKeyPair();
		}
		catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return keyPair;

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OidcClientRegistrationEndpointConfigurer.java
4 issues
Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 38 

               * @see OidcClientRegistrationEndpointFilter
 */
public final class OidcClientRegistrationEndpointConfigurer extends AbstractOAuth2Configurer {
	private RequestMatcher requestMatcher;

	/**
	 * Restrict for internal use only.
	 */
	OidcClientRegistrationEndpointConfigurer(ObjectPostProcessor<Object> objectPostProcessor) {

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 51 

              	<B extends HttpSecurityBuilder<B>> void init(B builder) {
		ProviderSettings providerSettings = OAuth2ConfigurerUtils.getProviderSettings(builder);
		this.requestMatcher = new AntPathRequestMatcher(
				providerSettings.getOidcClientRegistrationEndpoint(), HttpMethod.POST.name());

		OidcClientRegistrationAuthenticationProvider oidcClientRegistrationAuthenticationProvider =
				new OidcClientRegistrationAuthenticationProvider(
						OAuth2ConfigurerUtils.getRegisteredClientRepository(builder),
						OAuth2ConfigurerUtils.getAuthorizationService(builder));

Reported by PMD.

Potential violation of Law of Demeter (static property access)
Design

Line: 51 

              	<B extends HttpSecurityBuilder<B>> void init(B builder) {
		ProviderSettings providerSettings = OAuth2ConfigurerUtils.getProviderSettings(builder);
		this.requestMatcher = new AntPathRequestMatcher(
				providerSettings.getOidcClientRegistrationEndpoint(), HttpMethod.POST.name());

		OidcClientRegistrationAuthenticationProvider oidcClientRegistrationAuthenticationProvider =
				new OidcClientRegistrationAuthenticationProvider(
						OAuth2ConfigurerUtils.getRegisteredClientRepository(builder),
						OAuth2ConfigurerUtils.getAuthorizationService(builder));

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 68 

              		OidcClientRegistrationEndpointFilter oidcClientRegistrationEndpointFilter =
				new OidcClientRegistrationEndpointFilter(
						authenticationManager,
						providerSettings.getOidcClientRegistrationEndpoint());
		builder.addFilterAfter(postProcess(oidcClientRegistrationEndpointFilter), FilterSecurityInterceptor.class);
	}

	@Override
	RequestMatcher getRequestMatcher() {

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2EndpointUtils.java
4 issues
Potential violation of Law of Demeter (object not created locally)
Design

Line: 44 

              
	static MultiValueMap<String, String> getParameters(HttpServletRequest request) {
		Map<String, String[]> parameterMap = request.getParameterMap();
		MultiValueMap<String, String> parameters = new LinkedMultiValueMap<>(parameterMap.size());
		parameterMap.forEach((key, values) -> {
			if (values.length > 0) {
				for (String value : values) {
					parameters.add(key, value);
				}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 45 

              	static MultiValueMap<String, String> getParameters(HttpServletRequest request) {
		Map<String, String[]> parameterMap = request.getParameterMap();
		MultiValueMap<String, String> parameters = new LinkedMultiValueMap<>(parameterMap.size());
		parameterMap.forEach((key, values) -> {
			if (values.length > 0) {
				for (String value : values) {
					parameters.add(key, value);
				}
			}

Reported by PMD.

Potential violation of Law of Demeter (static property access)
Design

Line: 56 

              	}

	static boolean matchesPkceTokenRequest(HttpServletRequest request) {
		return AuthorizationGrantType.AUTHORIZATION_CODE.getValue().equals(
				request.getParameter(OAuth2ParameterNames.GRANT_TYPE)) &&
				request.getParameter(OAuth2ParameterNames.CODE) != null &&
				request.getParameter(PkceParameterNames.CODE_VERIFIER) != null;
	}

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 56 

              	}

	static boolean matchesPkceTokenRequest(HttpServletRequest request) {
		return AuthorizationGrantType.AUTHORIZATION_CODE.getValue().equals(
				request.getParameter(OAuth2ParameterNames.GRANT_TYPE)) &&
				request.getParameter(OAuth2ParameterNames.CODE) != null &&
				request.getParameter(PkceParameterNames.CODE_VERIFIER) != null;
	}

Reported by PMD.

samples/boot/oauth2-integration/client/src/main/java/sample/config/SecurityConfig.java
3 issues
A method/constructor should not explicitly throw java.lang.Exception
Design

Line: 40 

              
	// @formatter:off
	@Bean
	SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
		http
			.authorizeRequests(authorizeRequests ->
				authorizeRequests.anyRequest().authenticated()
			)
			.oauth2Login(oauth2Login ->

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 41 

              	// @formatter:off
	@Bean
	SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
		http
			.authorizeRequests(authorizeRequests ->
				authorizeRequests.anyRequest().authenticated()
			)
			.oauth2Login(oauth2Login ->
				oauth2Login.loginPage("/oauth2/authorization/messaging-client-oidc"))

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 41 

              	// @formatter:off
	@Bean
	SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
		http
			.authorizeRequests(authorizeRequests ->
				authorizeRequests.anyRequest().authenticated()
			)
			.oauth2Login(oauth2Login ->
				oauth2Login.loginPage("/oauth2/authorization/messaging-client-oidc"))

Reported by PMD.