Skip to content

Fix CodeQL note-severity alerts: uncaught NumberFormatException in the examples - #831

Open
vharseko wants to merge 1 commit into
OpenIdentityPlatform:masterfrom
vharseko:codeql/nfe-examples
Open

Fix CodeQL note-severity alerts: uncaught NumberFormatException in the examples#831
vharseko wants to merge 1 commit into
OpenIdentityPlatform:masterfrom
vharseko:codeql/nfe-examples

Conversation

@vharseko

@vharseko vharseko commented Aug 3, 2026

Copy link
Copy Markdown
Member

Sixth and last batch of note-severity code scanning fixes for the java/uncaught-number-format-exception rule (after #814, #817, #823, #826 and #829): the 32 alerts left in the example applications, which #829 deliberately did not touch.

Every one of them is the port the example connects to, parsed straight from the command line:

final int port = Integer.parseInt(args[1]);

Running an example with a non numeric port therefore ended with a NumberFormatException stack trace, while every other invalid argument of the same examples is reported properly (Unknown scope: …, usage message, System.exit(CLIENT_SIDE_PARAM_ERROR)).

What changed

  • opendj-ldap-sdk-examples (28 alerts, 26 files) — a new package private ExampleUtils.parsePort() reports an invalid port on standard error and exits with CLIENT_SIDE_PARAM_ERROR, which is exactly what these examples already do for an unknown scope. Each call site becomes final int port = parsePort(args[1]); plus one static import.
  • opendj-embedded-server-examples (4 alerts, 2 files) — SetupServer and ConfigureServer keep a private parsePort() of their own: the module is separate and only has two affected files, so duplicating a ten line helper is preferable to sharing a class across artifacts of the same package. The default ports (1500, 4500, 1600) and the surrounding conditionals are unchanged.

Documentation

The argument parsing of these examples sits before the // --- JCite --- markers, so the regions included into the documentation are untouched — the samples read exactly as before where it matters.

The static import blocks of the modified files are sorted and separated from the regular imports.

Testing

The example modules have no tests; both opendj-ldap-sdk-examples and opendj-embedded-server-examples compile cleanly, and no Integer.parseInt(args…) remains in either module.

…e examples

The example applications parse the port they connect to straight from the
command line, so running one with a non numeric port ended with a
NumberFormatException stack trace instead of the argument error the examples
report for every other invalid argument.

* The SDK examples share a new package private ExampleUtils.parsePort(), which
  reports an invalid port on standard error and exits with
  CLIENT_SIDE_PARAM_ERROR, exactly like the existing checks of these examples do
  for an unknown scope or a missing argument.
* The two embedded server examples keep a private parsePort() of their own, so
  that each of them stays self contained.

The parsing happens before the "--- JCite ---" markers of the examples, so the
code included into the documentation is unchanged. The static import blocks of
the modified files are sorted and separated from the other imports.
@vharseko
vharseko requested a review from maximthomas August 3, 2026 13:22
@vharseko vharseko added security Security fixes / CodeQL code-scanning alerts java Pull requests that update java code labels Aug 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

java Pull requests that update java code security Security fixes / CodeQL code-scanning alerts

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants