[3.27] 3.27.6 backports 4

bom/application/pom.xml

@@ -112,7 +112,7 @@
         <wildfly-elytron.version>2.6.5.Final</wildfly-elytron.version>
         <jboss-marshalling.version>2.2.3.Final</jboss-marshalling.version>
         <jboss-threads.version>3.9.1</jboss-threads.version>
-        <vertx.version>4.5.32</vertx.version>
+        <vertx.version>4.5.33</vertx.version>
         <httpclient.version>4.5.14</httpclient.version>
         <httpcore.version>4.4.16</httpcore.version>
         <httpasync.version>4.1.5</httpasync.version>
@@ -221,7 +221,7 @@
         <!-- Dev UI -->
         <importmap.version>1.0.11</importmap.version>
         <webauthn4j.version>0.28.0.RELEASE</webauthn4j.version>
-        <jsoup.version>1.23.1</jsoup.version> <!-- JSoup is used by Camel and LangChain4J so be careful when updating -->
+        <jsoup.version>1.23.2</jsoup.version> <!-- JSoup is used by Camel and LangChain4J so be careful when updating -->
         <reactor.version>3.8.7</reactor.version>
     </properties>
 

extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java

@@ -845,6 +845,10 @@ public static JsonObject decodeJwtContent(String jwt) {
 
     public static String getJwtContentPart(String jwt) {
         StringTokenizer tokens = new StringTokenizer(jwt, ".");
+        if (!tokens.hasMoreTokens()) {
+            // An empty or delimiter-only token has no parts at all.
+            return null;
+        }
         // part 1: skip the token headers
         tokens.nextToken();
         if (!tokens.hasMoreTokens()) {

extensions/oidc-common/runtime/src/test/java/io/quarkus/oidc/common/runtime/OidcCommonUtilsTest.java

@@ -1,6 +1,7 @@
 package io.quarkus.oidc.common.runtime;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
 
 import java.net.URI;
 import java.nio.charset.StandardCharsets;
@@ -194,6 +195,37 @@ public static String getJwtContentPart(String jwt) {
         return encodedContent;
     }
 
+    @Test
+    public void testDecodeJwtContentWithNoParts() {
+        // An empty or delimiter-only bearer token has zero StringTokenizer tokens.
+        // These used to throw NoSuchElementException out of getJwtContentPart, which
+        // escaped BearerAuthenticationMechanism as a non-AuthenticationFailedException
+        // and surfaced as HTTP 500 instead of a 401 challenge.
+        assertNull(OidcCommonUtils.decodeJwtContent(""));
+        assertNull(OidcCommonUtils.decodeJwtContent("."));
+        assertNull(OidcCommonUtils.decodeJwtContent(".."));
+        assertNull(OidcCommonUtils.decodeJwtContent("..."));
+        assertNull(OidcCommonUtils.decodeJwtContent("...."));
+    }
+
+    @Test
+    public void testGetJwtContentPartWithNoParts() {
+        assertNull(OidcCommonUtils.getJwtContentPart(""));
+        assertNull(OidcCommonUtils.getJwtContentPart("."));
+        assertNull(OidcCommonUtils.getJwtContentPart(".."));
+        assertNull(OidcCommonUtils.getJwtContentPart("..."));
+    }
+
+    @Test
+    public void testGetJwtContentPartStillRejectsWrongPartCounts() {
+        // Regression guard: the new zero-token check must not change how tokens
+        // with the wrong number of parts are treated.
+        assertNull(OidcCommonUtils.getJwtContentPart("onlyonepart"));
+        assertNull(OidcCommonUtils.getJwtContentPart("two.parts"));
+        assertNull(OidcCommonUtils.getJwtContentPart("a.b.c.d"));
+        assertEquals("b", OidcCommonUtils.getJwtContentPart("a.b.c"));
+    }
+
     private static JsonObject decodeAsJsonObject(String encodedContent) {
         try {
             return new JsonObject(base64UrlDecode(encodedContent));

extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcUtils.java

@@ -239,11 +239,17 @@ public static String decodeJwtContentAsString(String jwt) {
 
     public static JsonObject decodeJwtHeaders(String jwt) {
         StringTokenizer tokens = new StringTokenizer(jwt, ".");
+        if (!tokens.hasMoreTokens()) {
+            return null;
+        }
         return decodeAsJsonObject(tokens.nextToken());
     }
 
     public static String decodeJwtHeadersAsString(String jwt) {
         StringTokenizer tokens = new StringTokenizer(jwt, ".");
+        if (!tokens.hasMoreTokens()) {
+            return null;
+        }
         return base64UrlDecode(tokens.nextToken());
     }
 

independent-projects/resteasy-reactive/pom.xml

@@ -58,7 +58,7 @@
         <mutiny.version>3.1.0</mutiny.version>
         <smallrye-mutiny-vertx-core.version>3.21.6</smallrye-mutiny-vertx-core.version>
         <smallrye-common.version>2.13.9</smallrye-common.version>
-        <vertx.version>4.5.32</vertx.version>
+        <vertx.version>4.5.33</vertx.version>
         <rest-assured.version>5.5.6</rest-assured.version>
         <commons-logging-jboss-logging.version>1.0.0.Final</commons-logging-jboss-logging.version>
         <jackson-bom.version>2.21.4</jackson-bom.version>

independent-projects/vertx-utils/pom.xml

@@ -17,7 +17,7 @@
 
     <properties>
         <jboss-logging.version>3.6.1.Final</jboss-logging.version>
-        <vertx.version>4.5.32</vertx.version>
+        <vertx.version>4.5.33</vertx.version>
     </properties>
 
     <dependencies>