Skip to content

fix(auth): annotate builder fields, setters, and getters as @Nullable across credential builders #14154

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
lqiu96 wants to merge 1 commit into from
Closed

fix(auth): annotate builder fields, setters, and getters as @Nullable across credential builders #14154

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions ...a/com/google/auth/credentialaccessboundary/ClientSideCredentialAccessBoundaryFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -603,12 +603,12 @@ public static Builder newBuilder() {
* with the desired configuration options.
*/
public static class Builder {
private GoogleCredentials sourceCredential;
private @Nullable GoogleCredentials sourceCredential;
private @Nullable HttpTransportFactory transportFactory;
private @Nullable String universeDomain;
private String tokenExchangeEndpoint;
private Duration minimumTokenLifetime;
private Duration refreshMargin;
private @Nullable String tokenExchangeEndpoint;
private @Nullable Duration minimumTokenLifetime;
private @Nullable Duration refreshMargin;
private Clock clock = Clock.SYSTEM; // Default to system clock;

private Builder() {}
Expand Down
2 changes: 1 addition & 1 deletion google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsCredentials.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,7 +237,7 @@ public Builder toBuilder() {

public static class Builder extends ExternalAccountCredentials.Builder {

private AwsSecurityCredentialsSupplier awsSecurityCredentialsSupplier;
private @Nullable AwsSecurityCredentialsSupplier awsSecurityCredentialsSupplier;

private @Nullable String regionalCredentialVerificationUrlOverride;

Expand Down
19 changes: 10 additions & 9 deletions google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsRequestSignature.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@
import java.util.HashMap;
import java.util.Map;
import org.jspecify.annotations.NullMarked;
import org.jspecify.annotations.Nullable;

/**
* Stores the AWS API request signature based on the AWS Signature Version 4 signing process, and
Expand Down Expand Up @@ -122,16 +123,16 @@ String getAuthorizationHeader() {

static class Builder {

private AwsSecurityCredentials awsSecurityCredentials;
private Map<String, String> canonicalHeaders;
private @Nullable AwsSecurityCredentials awsSecurityCredentials;
private @Nullable Map<String, String> canonicalHeaders;

private String signature;
private String credentialScope;
private String url;
private String httpMethod;
private String date;
private String region;
private String authorizationHeader;
private @Nullable String signature;
private @Nullable String credentialScope;
private @Nullable String url;
private @Nullable String httpMethod;
private @Nullable String date;
private @Nullable String region;
private @Nullable String authorizationHeader;

@CanIgnoreReturnValue
Builder setSignature(String signature) {
Expand Down
15 changes: 8 additions & 7 deletions google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ClientId.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@
import java.nio.charset.StandardCharsets;
import java.util.Map;
import org.jspecify.annotations.NullMarked;
import org.jspecify.annotations.Nullable;

/**
* An OAuth2 user authorization Client ID and associated information.
Expand All @@ -56,7 +57,7 @@ public class ClientId {
private static final String JSON_PARSE_ERROR = "Error parsing Client ID JSON: ";

private final String clientId;
private final String clientSecret;
private final @Nullable String clientSecret;

/**
* Constructs a client ID from an explicit ID and secret.
Expand Down Expand Up @@ -143,7 +144,7 @@ public static ClientId fromStream(InputStream stream) throws IOException {
* @param clientId Text identifier of the Client ID.
* @param clientSecret Secret to associated with the Client ID.
*/
private ClientId(String clientId, String clientSecret) {
private ClientId(String clientId, @Nullable String clientSecret) {
this.clientId = Preconditions.checkNotNull(clientId);
this.clientSecret = clientSecret;
}
Expand All @@ -162,7 +163,7 @@ public final String getClientId() {
*
* @return The secret associated with the Client ID.
*/
public final String getClientSecret() {
public final @Nullable String getClientSecret() {
return clientSecret;
}

Expand All @@ -176,9 +177,9 @@ public Builder toBuilder() {

public static class Builder {

private String clientId;
private @Nullable String clientId;

private String clientSecret;
private @Nullable String clientSecret;

protected Builder() {}

Expand All @@ -194,12 +195,12 @@ public Builder setClientId(String clientId) {
}

@CanIgnoreReturnValue
public Builder setClientSecret(String clientSecret) {
public Builder setClientSecret(@Nullable String clientSecret) {
this.clientSecret = clientSecret;
return this;
}

public String getClientSecret() {
public @Nullable String getClientSecret() {
return clientSecret;
}

Expand Down
6 changes: 3 additions & 3 deletions ...e-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CredentialAccessBoundary.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,8 +206,8 @@ public static Builder newBuilder() {
}

public static class Builder {
private String availableResource;
private List<String> availablePermissions;
private @Nullable String availableResource;
private @Nullable List<String> availablePermissions;

@Nullable private AvailabilityCondition availabilityCondition;

Expand Down Expand Up @@ -327,7 +327,7 @@ public static Builder newBuilder() {
}

public static final class Builder {
private String expression;
private @Nullable String expression;

@Nullable private String title;
@Nullable private String description;
Expand Down
4 changes: 2 additions & 2 deletions google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/DownscopedCredentials.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,8 +205,8 @@ public static Builder newBuilder() {

public static class Builder extends OAuth2Credentials.Builder {

private GoogleCredentials sourceCredential;
private CredentialAccessBoundary credentialAccessBoundary;
private @Nullable GoogleCredentials sourceCredential;
private @Nullable CredentialAccessBoundary credentialAccessBoundary;
private @Nullable HttpTransportFactory transportFactory;
private @Nullable String universeDomain;

Expand Down
52 changes: 26 additions & 26 deletions ...ava/oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,14 +85,14 @@
private static final long serialVersionUID = -2181779590486283287L;

private final String transportFactoryClassName;
private final String audience;
private final String tokenUrl;
private final String tokenInfoUrl;
private final String revokeUrl;
private final String clientId;
private final String clientSecret;
private final @Nullable String audience;
private final @Nullable String tokenUrl;
private final @Nullable String tokenInfoUrl;
private final @Nullable String revokeUrl;
private final @Nullable String clientId;
private final @Nullable String clientSecret;

private String refreshToken;
private @Nullable String refreshToken;
Comment on lines +88 to +95

@gemini-code-assist gemini-code-assist Bot Aug 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

In ExternalAccountAuthorizedUserCredentials, fields like audience, tokenUrl, and refreshToken are required for the credential to function (e.g., to perform token refresh). While these fields are appropriately marked as @Nullable in the Builder class (since they start as null before being set), they should remain non-nullable (unannotated under @NullMarked) in the ExternalAccountAuthorizedUserCredentials class itself. Annotating them as @Nullable in the main class weakens null safety, as it forces all internal usages to handle potential null values even though they are guaranteed to be non-null after successful construction/validation.

Suggested change
private final @Nullable String audience;
private final @Nullable String tokenUrl;
private final @Nullable String tokenInfoUrl;
private final @Nullable String revokeUrl;
private final @Nullable String clientId;
private final @Nullable String clientSecret;
private String refreshToken;
private @Nullable String refreshToken;
private final String audience;
private final String tokenUrl;
private final @Nullable String tokenInfoUrl;
private final @Nullable String revokeUrl;
private final @Nullable String clientId;
private final @Nullable String clientSecret;
private String refreshToken;


private transient HttpTransportFactory transportFactory;

Expand Down Expand Up @@ -134,7 +134,7 @@
* external source for authentication to Google Cloud Platform, you must validate it before
* providing it to any Google API or library. Providing an unvalidated credential configuration to
* Google APIs can compromise the security of your systems and data. For more information, refer
* to {@see <a

Check failure on line 137 in google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java

View workflow job for this annotation

GitHub Actions / BomContentAssertionsTest (Test for assertion logic in BomContentTest) 

no tag name after @

Check failure on line 137 in google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java

View workflow job for this annotation

GitHub Actions / bom-content-test 

no tag name after @
* href="https://cloud.google.com/docs/authentication/external/externally-sourced-credentials">documentation</a>}.
*
* @param credentialsStream the stream with the credential definition
Expand All @@ -153,7 +153,7 @@
* external source for authentication to Google Cloud Platform, you must validate it before
* providing it to any Google API or library. Providing an unvalidated credential configuration to
* Google APIs can compromise the security of your systems and data. For more information, refer
* to {@see <a

Check failure on line 156 in google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java

View workflow job for this annotation

GitHub Actions / BomContentAssertionsTest (Test for assertion logic in BomContentTest) 

no tag name after @

Check failure on line 156 in google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java

View workflow job for this annotation

GitHub Actions / bom-content-test 

no tag name after @
* href="https://cloud.google.com/docs/authentication/external/externally-sourced-credentials">documentation</a>}.
*
* @param credentialsStream the stream with the credential definition
Expand Down Expand Up @@ -417,14 +417,14 @@
/** Builder for {@link ExternalAccountAuthorizedUserCredentials}. */
public static class Builder extends GoogleCredentials.Builder {

private HttpTransportFactory transportFactory;
private String audience;
private String refreshToken;
private String tokenUrl;
private String tokenInfoUrl;
private String revokeUrl;
private String clientId;
private String clientSecret;
private @Nullable HttpTransportFactory transportFactory;
private @Nullable String audience;
private @Nullable String refreshToken;
private @Nullable String tokenUrl;
private @Nullable String tokenInfoUrl;
private @Nullable String revokeUrl;
private @Nullable String clientId;
private @Nullable String clientSecret;

protected Builder() {}

Expand All @@ -447,7 +447,7 @@
* @return this {@code Builder} object
*/
@CanIgnoreReturnValue
public Builder setHttpTransportFactory(HttpTransportFactory transportFactory) {
public Builder setHttpTransportFactory(@Nullable HttpTransportFactory transportFactory) {
this.transportFactory = transportFactory;
return this;
}
Expand All @@ -460,7 +460,7 @@
* @return this {@code Builder} object
*/
@CanIgnoreReturnValue
public Builder setAudience(String audience) {
public Builder setAudience(@Nullable String audience) {
this.audience = audience;
return this;
}
Expand All @@ -472,7 +472,7 @@
* @return this {@code Builder} object
*/
@CanIgnoreReturnValue
public Builder setTokenUrl(String tokenUrl) {
public Builder setTokenUrl(@Nullable String tokenUrl) {
this.tokenUrl = tokenUrl;
return this;
}
Expand All @@ -484,7 +484,7 @@
* @return this {@code Builder} object
*/
@CanIgnoreReturnValue
public Builder setTokenInfoUrl(String tokenInfoUrl) {
public Builder setTokenInfoUrl(@Nullable String tokenInfoUrl) {
this.tokenInfoUrl = tokenInfoUrl;
return this;
}
Expand All @@ -496,7 +496,7 @@
* @return this {@code Builder} object
*/
@CanIgnoreReturnValue
public Builder setRevokeUrl(String revokeUrl) {
public Builder setRevokeUrl(@Nullable String revokeUrl) {
this.revokeUrl = revokeUrl;
return this;
}
Expand All @@ -508,7 +508,7 @@
* @return this {@code Builder} object
*/
@CanIgnoreReturnValue
public Builder setRefreshToken(String refreshToken) {
public Builder setRefreshToken(@Nullable String refreshToken) {
this.refreshToken = refreshToken;
return this;
}
Expand All @@ -520,7 +520,7 @@
* @return this {@code Builder} object
*/
@CanIgnoreReturnValue
public Builder setClientId(String clientId) {
public Builder setClientId(@Nullable String clientId) {
this.clientId = clientId;
return this;
}
Expand All @@ -532,7 +532,7 @@
* @return this {@code Builder} object
*/
@CanIgnoreReturnValue
public Builder setClientSecret(String clientSecret) {
public Builder setClientSecret(@Nullable String clientSecret) {
this.clientSecret = clientSecret;
return this;
}
Expand All @@ -545,7 +545,7 @@
*/
@Override
@CanIgnoreReturnValue
public Builder setQuotaProjectId(String quotaProjectId) {
public Builder setQuotaProjectId(@Nullable String quotaProjectId) {
super.setQuotaProjectId(quotaProjectId);
return this;
}
Expand All @@ -558,7 +558,7 @@
*/
@Override
@CanIgnoreReturnValue
public Builder setAccessToken(AccessToken accessToken) {
public Builder setAccessToken(@Nullable AccessToken accessToken) {
super.setAccessToken(accessToken);
return this;
}
Expand All @@ -571,7 +571,7 @@
*/
@CanIgnoreReturnValue
@Override
public Builder setUniverseDomain(String universeDomain) {
public Builder setUniverseDomain(@Nullable String universeDomain) {
super.setUniverseDomain(universeDomain);
return this;
}
Expand Down
12 changes: 6 additions & 6 deletions ...auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -363,7 +363,7 @@
* external source for authentication to Google Cloud Platform, you must validate it before
* providing it to any Google API or library. Providing an unvalidated credential configuration to
* Google APIs can compromise the security of your systems and data. For more information, refer
* to {@see <a

Check failure on line 366 in google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java

View workflow job for this annotation

GitHub Actions / BomContentAssertionsTest (Test for assertion logic in BomContentTest) 

no tag name after @

Check failure on line 366 in google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java

View workflow job for this annotation

GitHub Actions / bom-content-test 

no tag name after @
* href="https://cloud.google.com/docs/authentication/external/externally-sourced-credentials">documentation</a>}.
*
* @param credentialsStream the stream with the credential definition
Expand All @@ -384,7 +384,7 @@
* external source for authentication to Google Cloud Platform, you must validate it before
* providing it to any Google API or library. Providing an unvalidated credential configuration to
* Google APIs can compromise the security of your systems and data. For more information, refer
* to {@see <a

Check failure on line 387 in google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java

View workflow job for this annotation

GitHub Actions / BomContentAssertionsTest (Test for assertion logic in BomContentTest) 

no tag name after @

Check failure on line 387 in google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java

View workflow job for this annotation

GitHub Actions / bom-content-test 

no tag name after @
* href="https://cloud.google.com/docs/authentication/external/externally-sourced-credentials">documentation</a>}.
*
* @param credentialsStream the stream with the credential definition
Expand Down Expand Up @@ -770,13 +770,13 @@
/** Base builder for external account credentials. */
public abstract static class Builder extends GoogleCredentials.Builder {

protected String audience;
protected String subjectTokenType;
protected String tokenUrl;
protected @Nullable String audience;
protected @Nullable String subjectTokenType;
protected @Nullable String tokenUrl;
protected @Nullable String tokenInfoUrl;
protected CredentialSource credentialSource;
protected EnvironmentProvider environmentProvider;
protected PropertyProvider propertyProvider;
protected @Nullable CredentialSource credentialSource;
protected @Nullable EnvironmentProvider environmentProvider;
protected @Nullable PropertyProvider propertyProvider;
protected @Nullable HttpTransportFactory transportFactory;

@Nullable protected String serviceAccountImpersonationUrl;
Expand Down
5 changes: 3 additions & 2 deletions ...-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountSupplierContext.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@
import com.google.errorprone.annotations.CanIgnoreReturnValue;
import java.io.Serializable;
import org.jspecify.annotations.NullMarked;
import org.jspecify.annotations.Nullable;

/**
* Context object to pass relevant variables from external account credentials to suppliers. This
Expand Down Expand Up @@ -87,8 +88,8 @@ static Builder newBuilder() {
/** Builder for external account supplier context. */
static class Builder {

protected String audience;
protected String subjectTokenType;
protected @Nullable String audience;
protected @Nullable String subjectTokenType;

/**
* Sets the Audience.
Expand Down
26 changes: 13 additions & 13 deletions google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,7 +144,7 @@
* external source for authentication to Google Cloud Platform, you must validate it before
* providing it to any Google API or library. Providing an unvalidated credential configuration to
* Google APIs can compromise the security of your systems and data. For more information, refer
* to {@see <a

Check failure on line 147 in google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java

View workflow job for this annotation

GitHub Actions / BomContentAssertionsTest (Test for assertion logic in BomContentTest) 

no tag name after @

Check failure on line 147 in google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java

View workflow job for this annotation

GitHub Actions / bom-content-test 

no tag name after @
* href="https://cloud.google.com/docs/authentication/external/externally-sourced-credentials">documentation</a>}.
*
* @param credentialsStream the stream with the credential definition.
Expand All @@ -163,7 +163,7 @@
* external source for authentication to Google Cloud Platform, you must validate it before
* providing it to any Google API or library. Providing an unvalidated credential configuration to
* Google APIs can compromise the security of your systems and data. For more information, refer
* to {@see <a

Check failure on line 166 in google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java

View workflow job for this annotation

GitHub Actions / BomContentAssertionsTest (Test for assertion logic in BomContentTest) 

no tag name after @

Check failure on line 166 in google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java

View workflow job for this annotation

GitHub Actions / bom-content-test 

no tag name after @
* href="https://cloud.google.com/docs/authentication/external/externally-sourced-credentials">documentation</a>}.
*
* @param credentialsStream the stream with the credential definition.
Expand Down Expand Up @@ -542,14 +542,14 @@
}

public static class Builder extends GoogleCredentials.Builder {
private String projectId;
private String privateKeyId;
private PrivateKey privateKey;
private String serviceIdentityName;
private URI tokenServerUri;
private String apiAudience;
private HttpTransportFactory transportFactory;
private String caCertPath;
private @Nullable String projectId;
private @Nullable String privateKeyId;
private @Nullable PrivateKey privateKey;
private @Nullable String serviceIdentityName;
private @Nullable URI tokenServerUri;
private @Nullable String apiAudience;
private @Nullable HttpTransportFactory transportFactory;
private @Nullable String caCertPath;
private int lifetime = DEFAULT_LIFETIME_IN_SECONDS;

protected Builder() {}
Expand Down Expand Up @@ -624,27 +624,27 @@
return this;
}

public String getProjectId() {
public @Nullable String getProjectId() {
return projectId;
}

public @Nullable String getPrivateKeyId() {
return privateKeyId;
}

public PrivateKey getPrivateKey() {
public @Nullable PrivateKey getPrivateKey() {
return privateKey;
}

public String getServiceIdentityName() {
public @Nullable String getServiceIdentityName() {
return serviceIdentityName;
}

public URI getTokenServerUri() {
public @Nullable URI getTokenServerUri() {
return tokenServerUri;
}

public HttpTransportFactory getHttpTransportFactory() {
public @Nullable HttpTransportFactory getHttpTransportFactory() {
return transportFactory;
}

Expand Down
Loading
Loading