From ca6e454cd58de5993aa8b80cb2321d89725ea125 Mon Sep 17 00:00:00 2001 From: Valera V Harseko Date: Thu, 23 Jul 2026 18:41:03 +0300 Subject: [PATCH 1/2] Clean up low-severity CodeQL code-quality alerts Resolve 17 CodeQL note-level alerts across 15 files: - inefficient-empty-string-test: use String.isEmpty() instead of ""-equality (8) - inefficient-string-constructor: drop redundant new String(...) wrappers (2) - inefficient-key-set-iterator: iterate entrySet() instead of keySet()+get() (2) - useless-tostring-call: remove toString() on values already String (2) - local-variable-is-never-read: remove dead local assignments (3) Behaviour is unchanged; all touched modules compile. --- .../java/org/forgerock/jaspi/modules/iwa/IWAModule.java | 2 +- .../java/org/forgerock/jaspi/modules/iwa/wdsso/WDSSO.java | 2 +- .../modules/session/jwt/AbstractJwtSessionModule.java | 2 +- .../jaspi/modules/session/openam/OpenAMSessionModule.java | 2 +- .../java/org/forgerock/doc/maven/build/ChunkedHtml.java | 2 -- .../src/main/java/org/forgerock/doc/maven/post/Html.java | 2 +- .../main/java/org/forgerock/json/fluent/JsonValue.java | 8 ++++---- .../java/org/forgerock/json/jose/jws/JwtSecureHeader.java | 4 ++-- .../forgerock/commons/launcher/OSGiFrameworkService.java | 2 +- .../src/main/java/org/forgerock/api/CrestApiProducer.java | 3 ++- .../java/org/forgerock/json/resource/MemoryBackend.java | 2 +- .../util/src/main/java/org/forgerock/json/JsonValue.java | 8 ++++---- .../src/main/java/org/forgerock/util/time/Duration.java | 2 +- .../com/savage7/maven/plugin/dependency/ArtifactItem.java | 2 +- persistit/doc/build/src/AsciiDocIndex.java | 1 - 15 files changed, 21 insertions(+), 23 deletions(-) diff --git a/commons/auth-filters/authn-filter/jaspi-modules/iwa-module/src/main/java/org/forgerock/jaspi/modules/iwa/IWAModule.java b/commons/auth-filters/authn-filter/jaspi-modules/iwa-module/src/main/java/org/forgerock/jaspi/modules/iwa/IWAModule.java index 376bb37d5..16b851a67 100644 --- a/commons/auth-filters/authn-filter/jaspi-modules/iwa-module/src/main/java/org/forgerock/jaspi/modules/iwa/IWAModule.java +++ b/commons/auth-filters/authn-filter/jaspi-modules/iwa-module/src/main/java/org/forgerock/jaspi/modules/iwa/IWAModule.java @@ -99,7 +99,7 @@ public Promise validateRequest(MessageInfoC String httpAuthorization = request.getHeaders().getFirst("Authorization"); try { - if (httpAuthorization == null || "".equals(httpAuthorization)) { + if (httpAuthorization == null || httpAuthorization.isEmpty()) { LOG.debug("IWAModule: Authorization Header NOT set in request."); response.getHeaders().put("WWW-Authenticate", "Negotiate"); diff --git a/commons/auth-filters/authn-filter/jaspi-modules/iwa-module/src/main/java/org/forgerock/jaspi/modules/iwa/wdsso/WDSSO.java b/commons/auth-filters/authn-filter/jaspi-modules/iwa-module/src/main/java/org/forgerock/jaspi/modules/iwa/wdsso/WDSSO.java index 60794206e..4babe45ab 100644 --- a/commons/auth-filters/authn-filter/jaspi-modules/iwa-module/src/main/java/org/forgerock/jaspi/modules/iwa/wdsso/WDSSO.java +++ b/commons/auth-filters/authn-filter/jaspi-modules/iwa-module/src/main/java/org/forgerock/jaspi/modules/iwa/wdsso/WDSSO.java @@ -234,7 +234,7 @@ private String getUserName(String user) { if (!returnRealm) { int index = user.indexOf("@"); if (index != -1) { - userName = user.toString().substring(0, index); + userName = user.substring(0, index); } } return userName; diff --git a/commons/auth-filters/authn-filter/jaspi-modules/jwt-session-module/src/main/java/org/forgerock/jaspi/modules/session/jwt/AbstractJwtSessionModule.java b/commons/auth-filters/authn-filter/jaspi-modules/jwt-session-module/src/main/java/org/forgerock/jaspi/modules/session/jwt/AbstractJwtSessionModule.java index c7aa805ba..4be90cde1 100644 --- a/commons/auth-filters/authn-filter/jaspi-modules/jwt-session-module/src/main/java/org/forgerock/jaspi/modules/session/jwt/AbstractJwtSessionModule.java +++ b/commons/auth-filters/authn-filter/jaspi-modules/jwt-session-module/src/main/java/org/forgerock/jaspi/modules/session/jwt/AbstractJwtSessionModule.java @@ -259,7 +259,7 @@ public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject * @return true if the String is non-null and non-empty. */ private boolean isEmpty(String s) { - return s == null || "".equals(s); + return s == null || s.isEmpty(); } /** diff --git a/commons/auth-filters/authn-filter/jaspi-modules/openam-session-module/src/main/java/org/forgerock/jaspi/modules/session/openam/OpenAMSessionModule.java b/commons/auth-filters/authn-filter/jaspi-modules/openam-session-module/src/main/java/org/forgerock/jaspi/modules/session/openam/OpenAMSessionModule.java index 19db304a5..0f24b3547 100644 --- a/commons/auth-filters/authn-filter/jaspi-modules/openam-session-module/src/main/java/org/forgerock/jaspi/modules/session/openam/OpenAMSessionModule.java +++ b/commons/auth-filters/authn-filter/jaspi-modules/openam-session-module/src/main/java/org/forgerock/jaspi/modules/session/openam/OpenAMSessionModule.java @@ -253,7 +253,7 @@ private KeyStore buildKeyStore(final String keystoreFile, final String type, fin * @return true if the String is non-null and non-empty. */ private boolean isEmpty(String s) { - return s == null || "".equals(s); + return s == null || s.isEmpty(); } /** diff --git a/commons/doc-maven-plugin/src/main/java/org/forgerock/doc/maven/build/ChunkedHtml.java b/commons/doc-maven-plugin/src/main/java/org/forgerock/doc/maven/build/ChunkedHtml.java index f4c27c23b..6acf5431e 100644 --- a/commons/doc-maven-plugin/src/main/java/org/forgerock/doc/maven/build/ChunkedHtml.java +++ b/commons/doc-maven-plugin/src/main/java/org/forgerock/doc/maven/build/ChunkedHtml.java @@ -110,7 +110,6 @@ void prepareOlinkDB() throws MojoExecutionException { cfg.add(element(name("targetDirectory"), m.path(m.getDocbkxOutputDirectory()) + "/html")); cfg.add(element(name("targetsFilename"), m.getDocumentSrcName() + ".html.target.db")); - final String base = FilenameUtils.getBaseName(m.getDocumentSrcName()); //cfg.add(element(name("chunkBaseDir"), chunkBaseDir)); executeMojo( @@ -148,7 +147,6 @@ void build() throws MojoExecutionException { cfg.add(element(name("includes"), docName + "/" + m.getDocumentSrcName())); - final String base = FilenameUtils.getBaseName(m.getDocumentSrcName()); //cfg.add(element(name("chunkBaseDir"), chunkBaseDir)); cfg.add(element(name("manifest"), diff --git a/commons/doc-maven-plugin/src/main/java/org/forgerock/doc/maven/post/Html.java b/commons/doc-maven-plugin/src/main/java/org/forgerock/doc/maven/post/Html.java index 87e899f9a..236b5e111 100644 --- a/commons/doc-maven-plugin/src/main/java/org/forgerock/doc/maven/post/Html.java +++ b/commons/doc-maven-plugin/src/main/java/org/forgerock/doc/maven/post/Html.java @@ -213,7 +213,7 @@ final void editBuiltHtml(final String htmlDir) throws MojoExecutionException { String linkToJira = getLinkToJira(); String gascript = ""; - if(m.getGoogleAnalyticsId() != null && !"".equals(m.getGoogleAnalyticsId())) { + if(m.getGoogleAnalyticsId() != null && !m.getGoogleAnalyticsId().isEmpty()) { gascript = IOUtils.toString( Html.class.getResourceAsStream("/endbody-ga.txt"), StandardCharsets.UTF_8); gascript = gascript.replace("ANALYTICS-ID", m.getGoogleAnalyticsId()); diff --git a/commons/json-fluent/src/main/java/org/forgerock/json/fluent/JsonValue.java b/commons/json-fluent/src/main/java/org/forgerock/json/fluent/JsonValue.java index 1e1041bce..b6359969d 100644 --- a/commons/json-fluent/src/main/java/org/forgerock/json/fluent/JsonValue.java +++ b/commons/json-fluent/src/main/java/org/forgerock/json/fluent/JsonValue.java @@ -1018,10 +1018,10 @@ public String toString() { } else if (isMap()) { sb.append("{ "); Map map = (Map)object; - for (Iterator i = map.keySet().iterator(); i.hasNext();) { - Object key = i.next(); - sb.append('"').append(key.toString()).append("\": "); - sb.append(new JsonValue(map.get(key)).toString()); // recursion + for (Iterator> i = map.entrySet().iterator(); i.hasNext();) { + Map.Entry entry = i.next(); + sb.append('"').append(entry.getKey().toString()).append("\": "); + sb.append(new JsonValue(entry.getValue()).toString()); // recursion if (i.hasNext()) { sb.append(", "); } diff --git a/commons/json-web-token/src/main/java/org/forgerock/json/jose/jws/JwtSecureHeader.java b/commons/json-web-token/src/main/java/org/forgerock/json/jose/jws/JwtSecureHeader.java index 7faa9abb7..b1b52ef73 100644 --- a/commons/json-web-token/src/main/java/org/forgerock/json/jose/jws/JwtSecureHeader.java +++ b/commons/json-web-token/src/main/java/org/forgerock/json/jose/jws/JwtSecureHeader.java @@ -77,7 +77,7 @@ public JwtSecureHeader(Map headers) { * @param jwkSetUrl The JWK Set URL. */ public void setJwkSetUrl(URL jwkSetUrl) { - put(JKU.value(), new String(jwkSetUrl.toString())); + put(JKU.value(), jwkSetUrl.toString()); } /** @@ -133,7 +133,7 @@ public JWK getJsonWebKey() { * @param x509Url The X.509 URL. */ public void setX509Url(URL x509Url) { - put(X5U.value(), new String(x509Url.toString())); + put(X5U.value(), x509Url.toString()); } /** diff --git a/commons/launcher/launcher/src/main/java/org/forgerock/commons/launcher/OSGiFrameworkService.java b/commons/launcher/launcher/src/main/java/org/forgerock/commons/launcher/OSGiFrameworkService.java index 9700a0333..450b2da9b 100644 --- a/commons/launcher/launcher/src/main/java/org/forgerock/commons/launcher/OSGiFrameworkService.java +++ b/commons/launcher/launcher/src/main/java/org/forgerock/commons/launcher/OSGiFrameworkService.java @@ -627,7 +627,7 @@ protected Properties loadPropertyFile(URI projectDirectory, String propertyFile) File pFile = new File(propertyFile); if (!pFile.isAbsolute()) { is = - projectDirectory.resolve(propertyFile.toString()).toURL().openConnection() + projectDirectory.resolve(propertyFile).toURL().openConnection() .getInputStream(); } else { is = pFile.toURI().toURL().openConnection().getInputStream(); diff --git a/commons/rest/api-descriptor/src/main/java/org/forgerock/api/CrestApiProducer.java b/commons/rest/api-descriptor/src/main/java/org/forgerock/api/CrestApiProducer.java index dd6ee4294..487ab8e72 100644 --- a/commons/rest/api-descriptor/src/main/java/org/forgerock/api/CrestApiProducer.java +++ b/commons/rest/api-descriptor/src/main/java/org/forgerock/api/CrestApiProducer.java @@ -12,6 +12,7 @@ * information: "Portions copyright [year] [name of copyright owner]". * * Copyright 2016 ForgeRock AS. + * Portions Copyrighted 2026 3A Systems, LLC. */ package org.forgerock.api; @@ -75,7 +76,7 @@ public ApiDescription withPath(ApiDescription api, String parentPath) { Paths.Builder paths = paths(); Set names = api.getPaths().getNames(); for (String subpath : names) { - paths.put(subpath.equals("") ? parentPath : parentPath + "/" + subpath, + paths.put(subpath.isEmpty() ? parentPath : parentPath + "/" + subpath, api.getPaths().get(subpath)); } return createApi(api.getDefinitions(), api.getErrors(), api.getServices(), paths.build()); diff --git a/commons/rest/json-resource/src/main/java/org/forgerock/json/resource/MemoryBackend.java b/commons/rest/json-resource/src/main/java/org/forgerock/json/resource/MemoryBackend.java index 91cb630c6..85128b2e8 100644 --- a/commons/rest/json-resource/src/main/java/org/forgerock/json/resource/MemoryBackend.java +++ b/commons/rest/json-resource/src/main/java/org/forgerock/json/resource/MemoryBackend.java @@ -82,7 +82,7 @@ static Cookie valueOf(String base64) throws ResourceException { final String[] splitKeys = split[1].split(","); for (String key : splitKeys) { - if (!key.equals("")) { + if (!key.isEmpty()) { sortKeys.add(SortKey.valueOf(key)); } } diff --git a/commons/util/util/src/main/java/org/forgerock/json/JsonValue.java b/commons/util/util/src/main/java/org/forgerock/json/JsonValue.java index ffc90395b..1aa8779da 100644 --- a/commons/util/util/src/main/java/org/forgerock/json/JsonValue.java +++ b/commons/util/util/src/main/java/org/forgerock/json/JsonValue.java @@ -1343,12 +1343,12 @@ public String toString() { } else if (isMap()) { sb.append("{ "); final Map map = (Map) object; - for (final Iterator i = map.keySet().iterator(); i.hasNext();) { - final Object key = i.next(); + for (final Iterator> i = map.entrySet().iterator(); i.hasNext();) { + final Map.Entry entry = i.next(); sb.append('"'); - appendEscapedString(sb, key.toString()); + appendEscapedString(sb, entry.getKey().toString()); sb.append("\": "); - sb.append(new JsonValue(map.get(key)).toString()); // recursion + sb.append(new JsonValue(entry.getValue()).toString()); // recursion if (i.hasNext()) { sb.append(", "); } diff --git a/commons/util/util/src/main/java/org/forgerock/util/time/Duration.java b/commons/util/util/src/main/java/org/forgerock/util/time/Duration.java index e79885547..f36eddf06 100644 --- a/commons/util/util/src/main/java/org/forgerock/util/time/Duration.java +++ b/commons/util/util/src/main/java/org/forgerock/util/time/Duration.java @@ -165,7 +165,7 @@ public static Duration duration(final String value) { for (String fragment : fragments) { fragment = fragment.trim(); - if ("".equals(fragment)) { + if (fragment.isEmpty()) { throw new IllegalArgumentException("Cannot parse empty duration, expecting ' ' pattern"); } diff --git a/maven-external-dependency-plugin/maven-external-dependency-plugin/src/main/java/com/savage7/maven/plugin/dependency/ArtifactItem.java b/maven-external-dependency-plugin/maven-external-dependency-plugin/src/main/java/com/savage7/maven/plugin/dependency/ArtifactItem.java index f5678a24a..2c1a10481 100644 --- a/maven-external-dependency-plugin/maven-external-dependency-plugin/src/main/java/com/savage7/maven/plugin/dependency/ArtifactItem.java +++ b/maven-external-dependency-plugin/maven-external-dependency-plugin/src/main/java/com/savage7/maven/plugin/dependency/ArtifactItem.java @@ -242,7 +242,7 @@ public ArtifactItem(final Artifact artifact) */ private String filterEmptyString(final String in) { - if (in == null || in.equals("")) + if (in == null || in.isEmpty()) { return null; } diff --git a/persistit/doc/build/src/AsciiDocIndex.java b/persistit/doc/build/src/AsciiDocIndex.java index aec7b3284..9bd4ec74a 100644 --- a/persistit/doc/build/src/AsciiDocIndex.java +++ b/persistit/doc/build/src/AsciiDocIndex.java @@ -177,7 +177,6 @@ private void indexOneTerm(final String wholeTag, String href, final String url, } else { - final String className = href.substring(0, pHtml).replace('/', '.'); final String name = href.substring(pHash + 1); final int pLeftParen = name.indexOf('('); if (pLeftParen == -1) { From eeaf9cc496373ce684aea558663a61c2c3d6ca9d Mon Sep 17 00:00:00 2001 From: Valera V Harseko Date: Thu, 23 Jul 2026 22:50:23 +0300 Subject: [PATCH 2/2] Resolve 7 note-level CodeQL code-quality alerts - java/local-shadows-field (5): rename local variables that shadowed fields in CsvAuditEventHandler, JsonFileWriter, and WarningHeader - java/call-to-object-tostring (1): log VersionedPath.getVersions() instead of the object's default toString() in CrestApiProducer - py/unused-import (1): drop the unused `import sys, os` in the persistit doc conf.py Behaviour is unchanged; all touched Java modules compile. --- .../handlers/csv/CsvAuditEventHandler.java | 20 +++++++++---------- .../audit/handlers/json/JsonFileWriter.java | 7 ++++--- .../forgerock/http/header/WarningHeader.java | 7 ++++--- .../org/forgerock/api/CrestApiProducer.java | 3 ++- persistit/doc/conf.py | 4 ++-- 5 files changed, 22 insertions(+), 19 deletions(-) diff --git a/commons/audit/handler-csv/src/main/java/org/forgerock/audit/handlers/csv/CsvAuditEventHandler.java b/commons/audit/handler-csv/src/main/java/org/forgerock/audit/handlers/csv/CsvAuditEventHandler.java index 2e82b5cfa..30ab5d02b 100644 --- a/commons/audit/handler-csv/src/main/java/org/forgerock/audit/handlers/csv/CsvAuditEventHandler.java +++ b/commons/audit/handler-csv/src/main/java/org/forgerock/audit/handlers/csv/CsvAuditEventHandler.java @@ -167,26 +167,26 @@ public CsvAuditEventHandler( } } - Map> fieldOrderByTopic = new HashMap<>(); - Map jsonPointerByField = new HashMap<>(); - Map fieldDotNotationByField = new HashMap<>(); + Map> orderByTopic = new HashMap<>(); + Map pointerByField = new HashMap<>(); + Map dotNotationByField = new HashMap<>(); for (String topic : this.eventTopicsMetaData.getTopics()) { try { Set fieldOrder = getFieldOrder(topic, this.eventTopicsMetaData); for (String field : fieldOrder) { - if (!jsonPointerByField.containsKey(field)) { - jsonPointerByField.put(field, new JsonPointer(field)); - fieldDotNotationByField.put(field, jsonPointerToDotNotation(field)); + if (!pointerByField.containsKey(field)) { + pointerByField.put(field, new JsonPointer(field)); + dotNotationByField.put(field, jsonPointerToDotNotation(field)); } } - fieldOrderByTopic.put(topic, Collections.unmodifiableSet(fieldOrder)); + orderByTopic.put(topic, Collections.unmodifiableSet(fieldOrder)); } catch (ResourceException e) { LOGGER.error(topic + " topic schema meta-data misconfigured."); } } - this.fieldOrderByTopic = Collections.unmodifiableMap(fieldOrderByTopic); - this.jsonPointerByField = Collections.unmodifiableMap(jsonPointerByField); - this.fieldDotNotationByField = Collections.unmodifiableMap(fieldDotNotationByField); + this.fieldOrderByTopic = Collections.unmodifiableMap(orderByTopic); + this.jsonPointerByField = Collections.unmodifiableMap(pointerByField); + this.fieldDotNotationByField = Collections.unmodifiableMap(dotNotationByField); } private CsvPreference createCsvPreference(final CsvAuditEventHandlerConfiguration config) { diff --git a/commons/audit/handler-json/src/main/java/org/forgerock/audit/handlers/json/JsonFileWriter.java b/commons/audit/handler-json/src/main/java/org/forgerock/audit/handlers/json/JsonFileWriter.java index 9fb9180d0..ce6c68556 100644 --- a/commons/audit/handler-json/src/main/java/org/forgerock/audit/handlers/json/JsonFileWriter.java +++ b/commons/audit/handler-json/src/main/java/org/forgerock/audit/handlers/json/JsonFileWriter.java @@ -12,6 +12,7 @@ * information: "Portions copyright [year] [name of copyright owner]". * * Copyright 2016 ForgeRock AS. + * Portions Copyrighted 2026 3A Systems, LLC. */ package org.forgerock.audit.handlers.json; @@ -275,12 +276,12 @@ private QueueConsumer(final String fileNameSuffix, final Set topics, filesToDelete = new HashSet<>(); // build map of topic files - final Map topicEntryMap = new HashMap<>(); + final Map entriesByTopic = new HashMap<>(); for (final String topic : topics) { final String fileName = topic + '.' + fileNameSuffix; - topicEntryMap.put(topic, new TopicEntry(fileName, configuration)); + entriesByTopic.put(topic, new TopicEntry(fileName, configuration)); } - this.topicEntryMap = Collections.unmodifiableMap(topicEntryMap); + this.topicEntryMap = Collections.unmodifiableMap(entriesByTopic); } /** diff --git a/commons/http-framework/core/src/main/java/org/forgerock/http/header/WarningHeader.java b/commons/http-framework/core/src/main/java/org/forgerock/http/header/WarningHeader.java index 474cf551f..6cf7f4fba 100644 --- a/commons/http-framework/core/src/main/java/org/forgerock/http/header/WarningHeader.java +++ b/commons/http-framework/core/src/main/java/org/forgerock/http/header/WarningHeader.java @@ -12,6 +12,7 @@ * information: "Portions copyright [year] [name of copyright owner]". * * Copyright 2015-2016 ForgeRock AS. + * Portions Copyrighted 2026 3A Systems, LLC. */ package org.forgerock.http.header; @@ -159,9 +160,9 @@ public static WarningHeader newWarning(final String agentName, final String fmt, * @param warning Single {@link Warning} */ public WarningHeader(final Warning warning) { - final List warnings = new ArrayList<>(1); - warnings.add(Reject.checkNotNull(warning)); - this.warnings = Collections.unmodifiableList(warnings); + final List warningList = new ArrayList<>(1); + warningList.add(Reject.checkNotNull(warning)); + this.warnings = Collections.unmodifiableList(warningList); } /** diff --git a/commons/rest/api-descriptor/src/main/java/org/forgerock/api/CrestApiProducer.java b/commons/rest/api-descriptor/src/main/java/org/forgerock/api/CrestApiProducer.java index 487ab8e72..a1c2f7936 100644 --- a/commons/rest/api-descriptor/src/main/java/org/forgerock/api/CrestApiProducer.java +++ b/commons/rest/api-descriptor/src/main/java/org/forgerock/api/CrestApiProducer.java @@ -91,7 +91,8 @@ public ApiDescription withVersion(ApiDescription api, Version version) { if (singleton(UNVERSIONED).equals(versionedPath.getVersions())) { paths.put(path, versionedPath().put(version, versionedPath.get(UNVERSIONED)).build()); } else { - throw new IllegalStateException("Trying to version something already versioned: " + versionedPath); + throw new IllegalStateException( + "Trying to version something already versioned: " + versionedPath.getVersions()); } } return createApi(api.getDefinitions(), api.getErrors(), api.getServices(), paths.build()); diff --git a/persistit/doc/conf.py b/persistit/doc/conf.py index bcdc757b1..6cddd647f 100644 --- a/persistit/doc/conf.py +++ b/persistit/doc/conf.py @@ -1,5 +1,7 @@ # -*- coding: utf-8 -*- # +# Portions Copyrighted 2026 3A Systems, LLC. +# # Persistit documentation build configuration file, created by # sphinx-quickstart on Fri May 18 15:19:04 2012. # @@ -11,8 +13,6 @@ # All configuration values have a default; values that are commented out # serve to show the default. -import sys, os - # If extensions (or modules to document with autodoc) are in another directory, # add these directories to sys.path here. If the directory is relative to the # documentation root, use os.path.abspath to make it absolute, like shown here.