Fix CodeQL warning-severity alerts: dead checks, boxed locals and three null dereferences

opendj-config/src/main/java/org/forgerock/opendj/config/dsconfig/BuildVersion.java

@@ -13,6 +13,7 @@
  *
  * Copyright 2008 Sun Microsystems, Inc.
  * Portions Copyright 2013-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.forgerock.opendj.config.dsconfig;
 
@@ -191,11 +192,8 @@ public int compareTo(final BuildVersion version) {
         if (major == version.major) {
             if (minor == version.minor) {
                 if (point == version.point) {
-                    if (rev == version.rev) {
-                        return 0;
-                    } else if (rev.compareTo(version.rev) < 0) {
-                        return -1;
-                    }
+                    // Compares the revisions as strings: they are VCS revisions, not numbers.
+                    return Integer.signum(rev.compareTo(version.rev));
                 } else if (point < version.point) {
                     return -1;
                 }

opendj-config/src/test/java/org/forgerock/opendj/config/dsconfig/BuildVersionTest.java

@@ -0,0 +1,46 @@
+/*
+ * The contents of this file are subject to the terms of the Common Development and
+ * Distribution License (the License). You may not use this file except in compliance with the
+ * License.
+ *
+ * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+ * specific language governing permission and limitations under the License.
+ *
+ * When distributing Covered Software, include this CDDL Header Notice in each file and include
+ * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+ * Header, with the fields enclosed by brackets [] replaced by your own identifying
+ * information: "Portions copyright [year] [name of copyright owner]".
+ *
+ * Copyright 2026 3A Systems, LLC.
+ */
+package org.forgerock.opendj.config.dsconfig;
+
+import org.forgerock.testng.ForgeRockTestCase;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+@Test(groups = { "precommit", "config" })
+public class BuildVersionTest extends ForgeRockTestCase {
+
+    @Test
+    public void testEqualRevisionsCompareEqual() {
+        // Two distinct String instances holding the same revision: the revisions must be compared
+        // by value, not by reference.
+        final String rev = "abcdef";
+        final String sameRev = new StringBuilder(rev).toString();
+        Assert.assertEquals(new BuildVersion(4, 0, 0, rev).compareTo(new BuildVersion(4, 0, 0, sameRev)), 0);
+    }
+
+    @Test
+    public void testRevisionsOrderVersionsWhichAreOtherwiseEqual() {
+        Assert.assertEquals(new BuildVersion(4, 0, 0, "aaa").compareTo(new BuildVersion(4, 0, 0, "bbb")), -1);
+        Assert.assertEquals(new BuildVersion(4, 0, 0, "bbb").compareTo(new BuildVersion(4, 0, 0, "aaa")), 1);
+    }
+
+    @Test
+    public void testVersionNumbersTakePrecedenceOverRevisions() {
+        Assert.assertEquals(new BuildVersion(3, 9, 9, "zzz").compareTo(new BuildVersion(4, 0, 0, "aaa")), -1);
+        Assert.assertEquals(new BuildVersion(4, 1, 0, "aaa").compareTo(new BuildVersion(4, 0, 9, "zzz")), 1);
+        Assert.assertEquals(new BuildVersion(4, 0, 1, "aaa").compareTo(new BuildVersion(4, 0, 0, "zzz")), 1);
+    }
+}

opendj-core/src/main/java/com/forgerock/opendj/util/ASCIICharProp.java

@@ -13,6 +13,7 @@
  *
  * Copyright 2009 Sun Microsystems, Inc.
  * Portions copyright 2011-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 
 package com.forgerock.opendj.util;
@@ -110,7 +111,7 @@ private ASCIICharProp(final char c) {
             this.isKeyChar = true;
             this.isCompatKeyChar = true;
             this.decimalValue = -1;
-            if (c >= 'a' && c <= 'f') {
+            if (c <= 'f') {
                 this.isHexChar = true;
                 this.hexValue = c - 87;
             } else {
@@ -127,7 +128,7 @@ private ASCIICharProp(final char c) {
             this.isKeyChar = true;
             this.isCompatKeyChar = true;
             this.decimalValue = -1;
-            if (c >= 'A' && c <= 'F') {
+            if (c <= 'F') {
                 this.isHexChar = true;
                 this.hexValue = c - 55;
             } else {

opendj-core/src/main/java/com/forgerock/opendj/util/StringPrepProfile.java

@@ -13,6 +13,7 @@
  *
  * Copyright 2010 Sun Microsystems, Inc.
  * Portions Copyright 2015 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package com.forgerock.opendj.util;
 
@@ -462,7 +463,7 @@ public static void prepareUnicode(final StringBuilder buffer, final ByteSequence
                     if (canMapToSpace(buffer, trim)) {
                         buffer.append(SPACE_CHAR);
                     }
-                } else if ((b >= '\u0000' && b <= '\u0008') || (b >= '\u000E' && b <= '\u001F')
+                } else if (b <= '\u0008' || (b >= '\u000E' && b <= '\u001F')
                         || b == '\u007F') {
                     // These characters are mapped to nothing and hence not
                     // copied over..

opendj-core/src/main/java/org/forgerock/opendj/ldap/AVA.java

@@ -166,9 +166,10 @@ static void escapeAttributeValue(final String str, final StringBuilder builder)
                         builder.append(StaticUtils.byteToLowerHex(b));
                     }
                 } else {
+                    // NUL needs no test here: it is already handled by the c < ' ' branch above.
                     if ((c == ' ' && si == length - 1)
                             || (c == '"' || c == '+' || c == ',' || c == ';' || c == '<'
-                            || c == '>' || c == '\\' || c == '\u0000' || c == '=')) {
+                            || c == '>' || c == '\\' || c == '=')) {
                         builder.append('\\');
                     }
                     builder.append(c);

opendj-core/src/main/java/org/forgerock/opendj/ldap/AttributeFilter.java

@@ -12,6 +12,7 @@
  * information: "Portions Copyright [year] [name of copyright owner]".
  *
  * Copyright 2013-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 
 package org.forgerock.opendj.ldap;
@@ -163,13 +164,19 @@ public Iterable<Attribute> getAllAttributes() {
                  * requested by the user.
                  */
                 return new Iterable<Attribute>() {
-                    private boolean hasNextMustIterate = true;
-                    private final Iterator<Attribute> iterator = entry.getAllAttributes().iterator();
-                    private Attribute next = null;
-
                     @Override
                     public Iterator<Attribute> iterator() {
+                        /*
+                         * The iteration state belongs to the iterator, not to this Iterable:
+                         * keeping it here is what allows the Iterable to be iterated more than
+                         * once, including by the toString() below.
+                         */
                         return new Iterator<Attribute>() {
+                            private boolean hasNextMustIterate = true;
+                            private final Iterator<Attribute> iterator =
+                                    entry.getAllAttributes().iterator();
+                            private Attribute next;
+
                             @Override
                             public boolean hasNext() {
                                 if (hasNextMustIterate) {

opendj-core/src/main/java/org/forgerock/opendj/ldap/GeneralizedTime.java

@@ -836,9 +836,9 @@ private GeneralizedTime(final Calendar calendar, final Date date, final long tim
 
     @Override
     public int compareTo(final GeneralizedTime o) {
-        final Long timeMS1 = getTimeInMillis();
-        final Long timeMS2 = o.getTimeInMillis();
-        return timeMS1.compareTo(timeMS2);
+        final long timeMS1 = getTimeInMillis();
+        final long timeMS2 = o.getTimeInMillis();
+        return Long.compare(timeMS1, timeMS2);
     }
 
     @Override

opendj-core/src/main/java/org/forgerock/opendj/ldap/InetAddressValidator.java

@@ -12,6 +12,7 @@
  * information: "Portions Copyright [year] [name of copyright owner]".
  *
  * Portions copyright 2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 /*
  * Licensed to the Apache Software Foundation (ASF) under one or more
@@ -184,7 +185,7 @@ public static boolean isValidInet6Address(String inet6Address) {
                     if (!inet6Address.endsWith(octet)) {
                         return false;
                     }
-                    if (index > octets.length - 1 || index > 6) {  // CHECKSTYLE IGNORE MagicNumber
+                    if (index > 6) {  // CHECKSTYLE IGNORE MagicNumber
                         // IPV4 occupies last two octets
                         return false;
                     }

opendj-core/src/main/java/org/forgerock/opendj/ldap/controls/PasswordPolicyResponseControl.java

@@ -138,8 +138,7 @@ public PasswordPolicyResponseControl decodeControl(final Control control,
                             // nested element.
                             reader.readStartSequence();
                             final int warningChoiceValue = (0x7F & reader.peekType());
-                            if (warningChoiceValue < 0
-                                    || warningChoiceValue >= PasswordPolicyWarningType.values().length) {
+                            if (warningChoiceValue >= PasswordPolicyWarningType.values().length) {
                                 final LocalizableMessage message =
                                         ERR_PWPOLICYRES_INVALID_WARNING_TYPE.get(byteToHex(reader
                                                 .peekType()));

opendj-core/src/main/java/org/forgerock/opendj/ldap/schema/NameForm.java

@@ -12,6 +12,7 @@
  * information: "Portions Copyright [year] [name of copyright owner]".
  *
  * Copyright 2009 Sun Microsystems, Inc.
+ * Portions Copyright 2026 3A Systems, LLC.
  * Portions copyright 2011-2016 ForgeRock AS.
  */
 package org.forgerock.opendj.ldap.schema;
@@ -334,7 +335,7 @@ private NameForm(final Builder builder) {
         if (builder.structuralObjectClassOID == null || builder.structuralObjectClassOID.isEmpty()) {
             throw new IllegalArgumentException("A structural class OID must be specified.");
         }
-        if (builder.requiredAttributes == null || builder.requiredAttributes.isEmpty()) {
+        if (builder.requiredAttributes.isEmpty()) {
             throw new IllegalArgumentException("Required attribute must be specified.");
         }
 

opendj-core/src/main/java/org/forgerock/opendj/ldap/schema/SchemaUtils.java

@@ -13,7 +13,7 @@
  *
  * Copyright 2009 Sun Microsystems, Inc.
  * Portions copyright 2011-2016 ForgeRock AS.
- * Portions Copyright 2024 3A Systems, LLC.
+ * Portions Copyright 2024-2026 3A Systems, LLC.
  */
 package org.forgerock.opendj.ldap.schema;
 
@@ -229,11 +229,8 @@ static String readOID(final SubstringReader reader, final boolean allowCompatCha
                         && (c = reader.read()) != ' '
                         && c != ')'
                         && (c != '\'' || !enclosingQuote)) {
-                    if (length == 0 && !isAlpha(c)) {
-                        throw DecodeException.error(
-                                ERR_ATTR_SYNTAX_ILLEGAL_CHAR_IN_STRING_OID1.get(c, reader.pos() - 1));
-                    }
-
+                    // The first character was already required to be alphabetic by the enclosing
+                    // test, so only the key-character check is needed here.
                     if (!isKeyChar(c, allowCompatChars)) {
                         throw DecodeException.error(
                                 ERR_ATTR_SYNTAX_ILLEGAL_CHAR_IN_STRING_OID1.get(c, reader.pos() - 1));
@@ -326,23 +323,15 @@ static String readOIDLen(final SubstringReader reader, final boolean allowCompat
                     }
                     length++;
                 }
-
-                if (length == 0) {
-                    throw DecodeException.error(
-                            ERR_ATTR_SYNTAX_OID_NO_VALUE1.get(reader.pos() - 1));
-                }
             } else if (isAlpha(c)) {
                 // This must be an attribute description. In this case, we will
                 // only accept alphabetic characters, numeric digits, and the hyphen.
                 while ((c = reader.read()) != ' '
                         && c != ')'
                         && c != '{'
                         && (c != '\'' || !enclosingQuote)) {
-                    if (length == 0 && !isAlpha(c)) {
-                        throw DecodeException.error(
-                                ERR_ATTR_SYNTAX_ILLEGAL_CHAR_IN_STRING_OID1.get(c, reader.pos() - 1));
-                    }
-
+                    // The first character was already required to be alphabetic by the enclosing
+                    // test, so only the key-character check is needed here.
                     if (!isKeyChar(c, allowCompatChars)) {
                         throw DecodeException.error(
                                 ERR_ATTR_SYNTAX_ILLEGAL_CHAR_IN_STRING_OID1.get(c, reader.pos() - 1));

opendj-core/src/main/java/org/forgerock/opendj/ldap/schema/UTCTimeSyntaxImpl.java

@@ -12,6 +12,7 @@
  * information: "Portions Copyright [year] [name of copyright owner]".
  *
  * Copyright 2009 Sun Microsystems, Inc.
+ * Portions Copyright 2026 3A Systems, LLC.
  * Portions copyright 2012-2016 ForgeRock AS.
  */
 package org.forgerock.opendj.ldap.schema;
@@ -399,16 +400,8 @@ public boolean valueIsAcceptable(final Schema schema, final ByteSequence value,
         case '3':
         case '4':
         case '5':
-            // There must be at least two more characters, and the next one
-            // must be a digit between 0 and 9.
-            if (length < 11) {
-                final LocalizableMessage message =
-                        ERR_ATTR_SYNTAX_UTC_TIME_INVALID_CHAR.get(valueString, String.valueOf(m1),
-                                8);
-                invalidReason.append(message);
-                return false;
-            }
-
+            // A length below 11 was already rejected at the top of this method, so the next
+            // character is present and must be a digit between 0 and 9.
             switch (valueString.charAt(9)) {
             case '0':
             case '1':

opendj-core/src/main/java/org/forgerock/opendj/ldif/TemplateTag.java

@@ -13,6 +13,7 @@
  *
  * Copyright 2006-2009 Sun Microsystems, Inc.
  * Portions Copyright 2013-2015 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.forgerock.opendj.ldif;
 
@@ -1322,7 +1323,7 @@ void initializeForTemplate(Schema schema, TemplateFile templateFile, Template te
         }
 
         private void initialize(String[] arguments, int lineNumber) throws DecodeException {
-            if (arguments.length < 0 || arguments.length > 2) {
+            if (arguments.length > 2) {
                 throw DecodeException.fatalError(ERR_ENTRY_GENERATOR_TAG_INVALID_ARGUMENT_RANGE_COUNT.get(
                         getName(), lineNumber, 0, 2, arguments.length));
             }

opendj-core/src/test/java/org/forgerock/opendj/ldap/AttributeFilterTestCase.java

@@ -0,0 +1,63 @@
+/*
+ * The contents of this file are subject to the terms of the Common Development and
+ * Distribution License (the License). You may not use this file except in compliance with the
+ * License.
+ *
+ * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+ * specific language governing permission and limitations under the License.
+ *
+ * When distributing Covered Software, include this CDDL Header Notice in each file and include
+ * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+ * Header, with the fields enclosed by brackets [] replaced by your own identifying
+ * information: "Portions copyright [year] [name of copyright owner]".
+ *
+ * Copyright 2026 3A Systems, LLC.
+ */
+package org.forgerock.opendj.ldap;
+
+import static org.fest.assertions.Assertions.assertThat;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.testng.annotations.Test;
+
+/**
+ * Test {@code AttributeFilter}.
+ */
+@SuppressWarnings("javadoc")
+public final class AttributeFilterTestCase extends SdkTestCase {
+
+    @Test
+    public void testFilteredViewCanBeIteratedMoreThanOnce() {
+        final Iterable<Attribute> attributes = filteredView().getAllAttributes();
+
+        final List<String> firstPass = namesOf(attributes);
+        assertThat(firstPass).isNotEmpty();
+        assertThat(namesOf(attributes)).isEqualTo(firstPass);
+    }
+
+    @Test
+    public void testFilteredViewCanBeIteratedAfterToString() {
+        final Iterable<Attribute> attributes = filteredView().getAllAttributes();
+
+        final List<String> expected = namesOf(attributes);
+        attributes.toString();
+        assertThat(namesOf(attributes)).isEqualTo(expected);
+    }
+
+    private Entry filteredView() {
+        final Entry entry =
+                new LinkedHashMapEntry("dn: cn=test", "objectClass: top", "objectClass: person",
+                        "cn: test", "sn: user");
+        return new AttributeFilter().filteredViewOf(entry);
+    }
+
+    private List<String> namesOf(final Iterable<Attribute> attributes) {
+        final List<String> names = new ArrayList<>();
+        for (final Attribute attribute : attributes) {
+            names.add(attribute.getAttributeDescriptionAsString());
+        }
+        return names;
+    }
+}

opendj-doc-maven-plugin/src/main/java/org/forgerock/opendj/maven/doc/GenerateConfigurationReferenceMojo.java

@@ -12,6 +12,7 @@
  * information: "Portions Copyright [year] [name of copyright owner]".
  *
  * Copyright 2015-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.forgerock.opendj.maven.doc;
 
@@ -151,7 +152,7 @@ private void generateConfigRef() throws MojoExecutionException {
      */
     private void copyResources() throws IOException {
         for (String file : resourceFiles) {
-            InputStream original = this.getClass().getResourceAsStream("/config-ref/" + file);
+            InputStream original = GenerateConfigurationReferenceMojo.class.getResourceAsStream("/config-ref/" + file);
             File copy = new File(outputDirectory, file);
             copyInputStreamToFile(original, copy);
         }

opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java

@@ -234,7 +234,7 @@ public void init(ServletConfig config) throws ServletException {
       // assign the DSMLv2 schema for validation
       if(schema==null)
       {
-        URL url = getClass().getResource("/resources/DSMLv2.xsd");
+        URL url = DSMLServlet.class.getResource("/resources/DSMLv2.xsd");
         if ( url != null ) {
           SchemaFactory sf = SchemaFactory.newInstance(W3C_XML_SCHEMA_NS_URI);
           schema = sf.newSchema(url);