Fix the warning-level CodeQL findings across the framework and connectors

OpenICF-csvfile-connector/src/main/java/org/forgerock/openicf/csvfile/CSVFileConnector.java

@@ -14,6 +14,7 @@
  * Copyright 2015-2016 ForgeRock AS
  * Portions Copyright 2011 Viliam Repan
  * Portions Copyright 2011 Radovan Semancik
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.forgerock.openicf.csvfile;
 
@@ -881,6 +882,9 @@ private ConnectorObject findObjectInFile(File file, Uid uid) {
     }
 
     private SyncDelta generateSyncDelta(ConnectorObject origin, ConnectorObject current, SyncToken token) {
+        if (origin == null && current == null) {
+            throw new IllegalArgumentException("Either the original or the current object is required");
+        }
         SyncDeltaBuilder builder = new SyncDeltaBuilder();
         builder.setUid(origin == null ? current.getUid() : origin.getUid());
         builder.setToken(token);

OpenICF-databasetable-connector/src/main/java/org/identityconnectors/databasetable/DatabaseTableConnector.java

@@ -459,7 +459,7 @@ public Uid update(ObjectClass oclass, Uid uid, Set<Attribute> attrs, OperationOp
                     log.info("Append empty attribute {0} for required columnName {1}", attributeName, columnName);        
                     value = DatabaseTableConstants.EMPTY_STR;
                 }                
-                final Integer sqlType = getColumnType(columnName);
+                final int sqlType = getColumnType(columnName);
                 final SQLParam param = new SQLParam(quoteName(columnName), value, sqlType);
                 updateSet.addBind(param);
                 log.ok("Appended to update statement the attribute {0} for columnName {1} and sqlType {2}", attributeName, columnName, sqlType);                        
@@ -609,7 +609,7 @@ public void sync(ObjectClass oclass, SyncToken token, SyncResultsHandler handler
         if(token != null && token.getValue() != null) {
             final Object tokenVal = token.getValue();
             log.info("Sync token is {0}", tokenVal);        
-            final Integer sqlType = getColumnType(config.getChangeLogColumn());
+            final int sqlType = getColumnType(config.getChangeLogColumn());
             where.addBind(new SQLParam(changeLogColumnName, tokenVal, sqlType),">" );
         }
         final DatabaseQueryBuilder query = new DatabaseQueryBuilder(tblname, columnNames);
@@ -1082,7 +1082,7 @@ private Set<AttributeInfo> buildAttributeInfoSet(ResultSet rset) throws SQLExcep
         for (int i = 1; i <= count; i++) {
             final String name = meta.getColumnName(i);
             final AttributeInfoBuilder attrBld = new AttributeInfoBuilder();
-            final Integer columnType = meta.getColumnType(i);
+            final int columnType = meta.getColumnType(i);
             log.ok("column name {0} has type {1}", name, columnType);
             columnSQLTypes.put(name, columnType);
             if (name.equalsIgnoreCase(config.getKeyColumn())) {

OpenICF-databasetable-connector/src/main/java/org/identityconnectors/databasetable/DatabaseTableFilterTranslator.java

@@ -57,7 +57,7 @@ public DatabaseTableFilterTranslator(DatabaseTableConnector connector, ObjectCla
     protected SQLParam getSQLParam(Attribute attribute, ObjectClass oclass, OperationOptions options) {
         final Object value = AttributeUtil.getSingleValue(attribute);
         final String columnName = connector.getColumnName(attribute.getName());
-        final Integer columnType = connector.getColumnType(columnName);
+        final int columnType = connector.getColumnType(columnName);
         return new SQLParam(columnName, value,columnType);
     }
 

OpenICF-dbcommon/src/main/java/org/identityconnectors/dbcommon/PropertiesResolver.java

@@ -130,7 +130,7 @@ private static String resolveValue(String value, Properties properties,
         int index = 0;
         int length = value.length();
         StringBuffer result = new StringBuffer();
-        while (index >= 0 && index < length) {
+        while (index < length) {
             int varStart = value.indexOf("${", index);
             if (varStart >= 0) {
                 int varEnd = value.indexOf('}', varStart);

OpenICF-dbcommon/src/main/java/org/identityconnectors/dbcommon/SQLParam.java

@@ -19,9 +19,11 @@
  * enclosed by brackets [] replaced by your own identifying information:
  * "Portions Copyrighted [year] [name of copyright owner]"
  * ====================
+ * Portions Copyrighted 2026 3A Systems, LLC
  */
 package org.identityconnectors.dbcommon;
 
+import java.util.Objects;
 import java.sql.Types;
 
 /**
@@ -109,8 +111,7 @@ public boolean equals(Object obj) {
             return false;
         }
         SQLParam other = (SQLParam) obj;
-        return (name == other.name || (name != null && name.equals(other.name)))
-                && (value == other.value || (value != null && value.equals(other.value)))
+        return Objects.equals(name, other.name) && Objects.equals(value, other.value)
                 && sqlType == other.sqlType;
     }
 

OpenICF-groovy-connector/src/main/java/org/forgerock/openicf/misc/crest/AbstractRemoteConnection.java

@@ -80,6 +80,7 @@
 import org.forgerock.json.resource.CreateRequest;
 import org.forgerock.json.resource.DeleteRequest;
 import org.forgerock.json.resource.InternalServerErrorException;
+import org.forgerock.json.resource.NotSupportedException;
 import org.forgerock.json.resource.PatchOperation;
 import org.forgerock.json.resource.PatchRequest;
 import org.forgerock.json.resource.QueryRequest;
@@ -492,6 +493,8 @@ private HttpUriRequest convert(Request request) throws ResourceException {
                 rq = new HttpGet(builder.build());
                 break;
             }
+            default:
+                throw new NotSupportedException("Unsupported request type: " + request.getRequestType());
             }
         } catch (URISyntaxException e) {
             throw new InternalServerErrorException(e);
@@ -708,7 +711,7 @@ public HttpResponseResourceException(ResourceException wrapped) {
         }
 
         @Override
-        public ResourceException getCause() {
+        public synchronized ResourceException getCause() {
             return cause;
         }
     }

OpenICF-groovy-connector/src/main/java/org/forgerock/openicf/misc/scriptedcommon/ScriptedConfiguration.java

@@ -782,24 +782,25 @@ protected Log getLogger(final Class<?> clazz) {
 
     private GroovyScriptEngine groovyScriptEngine = null;
 
-    protected GroovyScriptEngine getGroovyScriptEngine() {
+    /**
+     * Synchronised for the whole initialisation, not double-checked: the
+     * customizer script runs against the half-initialised engine (it may call
+     * back into this configuration, which re-enters here), so other threads
+     * have to wait until it has run rather than see the engine early.
+     */
+    protected synchronized GroovyScriptEngine getGroovyScriptEngine() {
         if (null == groovyScriptEngine) {
-            synchronized (this) {
-                if (null == groovyScriptEngine) {
-
-                    final CompilerConfiguration compilerConfiguration =
-                            new CompilerConfiguration(config);
-                    compilerConfiguration.addCompilationCustomizers(getImportCustomizer(null));
+            final CompilerConfiguration compilerConfiguration =
+                    new CompilerConfiguration(config);
+            compilerConfiguration.addCompilationCustomizers(getImportCustomizer(null));
 
-                    final GroovyClassLoader loader =
-                            new GroovyClassLoader(getParentLoader(), compilerConfiguration, true);
+            final GroovyClassLoader loader =
+                    new GroovyClassLoader(getParentLoader(), compilerConfiguration, true);
 
-                    groovyScriptEngine =
-                            new GroovyScriptEngine(getRoots(compilerConfiguration, loader), loader);
+            groovyScriptEngine =
+                    new GroovyScriptEngine(getRoots(compilerConfiguration, loader), loader);
 
-                    initializeCustomizer();
-                }
-            }
+            initializeCustomizer();
         }
         return groovyScriptEngine;
     }

OpenICF-java-framework/connector-framework-contract/src/main/java/org/identityconnectors/contract/test/MultiOpTests.java

@@ -21,6 +21,7 @@
  * ====================
  *
  * Portions Copyrighted 2012 ForgeRock AS
+ * Portions Copyrighted 2026 3A Systems, LLC
  *
  */
 package org.identityconnectors.contract.test;
@@ -32,6 +33,7 @@
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.HashSet;
+import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -102,7 +104,7 @@ protected void testRun(ObjectClass objectClass) {
         List<Set<Attribute>> attrs = new ArrayList<Set<Attribute>>();
 
         // objects stored in connector resource before test
-        Map<Uid, ConnectorObject> coBeforeTest = null;
+        Map<Uid, ConnectorObject> coBeforeTest = Collections.emptyMap();
 
         // sync variables
         SyncToken token = null;
@@ -792,7 +794,7 @@ private ObjectClassInfo findOInfo(ObjectClass oclass) {
      */
     private static boolean canLockOut() {
         // by default it's supposed that case insensitive search is disabled.
-        Boolean canLockout = true;
+        boolean canLockout = true;
         try {
             canLockout = !(Boolean) getDataProvider().getTestSuiteAttribute(
                     SKIP + "." + LOCKOUT_PREFIX,

OpenICF-java-framework/connector-framework-contract/src/main/java/org/identityconnectors/contract/test/ObjectClassRunner.java

@@ -227,6 +227,10 @@ public boolean isObjectClassSupported(ObjectClass objectClass) {
                 oinfos = tmp;
             }
         }
+        if (oinfos == null) {
+            // no operation required: every object class of the schema qualifies
+            oinfos = getSchema().getObjectClassInfo();
+        }
 
         // Find the objectclass in set of supported objectclasses (oinfos),
         // that is currently tested. If it is present set the indicator _ocSupported accordingly.

OpenICF-java-framework/connector-framework-contract/src/main/java/org/identityconnectors/contract/test/SearchApiOpTests.java

@@ -21,6 +21,7 @@
  * ====================
  *
  * Portions Copyrighted 2012 ForgeRock AS
+ * Portions Copyrighted 2026 3A Systems, LLC
  *
  */
 package org.identityconnectors.contract.test;
@@ -416,7 +417,7 @@ static String changeCase(String str_uid) {
      */
     protected static boolean canSearchCaseInsensitive() {
         // by default it's supposed that case insensitive search is disabled.
-        Boolean canSearchCIns = true;
+        boolean canSearchCIns = true;
         try {
             canSearchCIns = !(Boolean) getDataProvider().getTestSuiteAttribute(
                     DISABLE + "." + CASE_INSENSITIVE_PREFIX,

OpenICF-java-framework/connector-framework-contract/src/main/java/org/identityconnectors/contract/test/SyncApiOpTests.java

@@ -21,6 +21,7 @@
  * ====================
  *
  * Portions Copyrighted 2012 ForgeRock AS
+ * Portions Copyrighted 2026 3A Systems, LLC
  *
  */
 package org.identityconnectors.contract.test;
@@ -314,7 +315,7 @@ public String getTestName() {
      */
     protected static boolean canSyncAfterOp(Class<? extends APIOperation> operation) {
         // by default it's supposed that sync works for all change types
-        Boolean canSync = true;
+        boolean canSync = true;
         try {
             if (operation.equals(CreateApiOp.class)) {
                 canSync = !(Boolean) getDataProvider().getTestSuiteAttribute(

OpenICF-java-framework/connector-framework-internal/src/main/java/org/identityconnectors/framework/impl/api/local/ObjectPool.java

@@ -247,15 +247,13 @@ public ObjectPoolEntry<T> borrowObject() {
                 try {
                     handler.testObject(rv.getPooledObject());
                 } catch (Exception e) {
-                    if (null != rv) {
-                        dispose(rv);
-                        // if it's a new object, break out of the loop
-                        // immediately
-                        if (rv.isNew()) {
-                            throw ConnectorException.wrap(e);
-                        }
-                        rv = null;
+                    dispose(rv);
+                    // if it's a new object, break out of the loop
+                    // immediately
+                    if (rv.isNew()) {
+                        throw ConnectorException.wrap(e);
                     }
+                    rv = null;
                 }
             } while (null == rv);
             rv.setActive(true);

OpenICF-java-framework/connector-framework-internal/src/main/java/org/identityconnectors/framework/impl/api/local/operations/OperationalContext.java

@@ -85,14 +85,16 @@ public Configuration getConfiguration() {
         if (null == configuration) {
             synchronized (this) {
                 if (null == configuration) {
-                    this.configuration =
+                    // fully set up before it is published to other threads
+                    final Configuration bean =
                             JavaClassProperties.createBean(apiConfiguration
                                     .getConfigurationProperties(), connectorInfo
                                     .getConnectorConfigurationClass());
                     if (null != apiConfiguration.getChangeListener()
-                            && configuration instanceof AbstractConfiguration) {
-                        ((AbstractConfiguration) configuration).addChangeCallback(this);
+                            && bean instanceof AbstractConfiguration) {
+                        ((AbstractConfiguration) bean).addChangeCallback(this);
                     }
+                    this.configuration = bean;
                 }
             }
         }

OpenICF-java-framework/connector-framework-internal/src/main/java/org/identityconnectors/framework/impl/api/local/operations/SyncImpl.java

@@ -20,6 +20,7 @@
  * "Portions Copyrighted [year] [name of copyright owner]"
  * ====================
  * Portions Copyrighted 2010-2015 ForgeRock AS.
+ * Portions Copyrighted 2026 3A Systems, LLC
  */
 package org.identityconnectors.framework.impl.api.local.operations;
 
@@ -68,7 +69,7 @@ public SyncToken sync(final ObjectClass objectClass, final SyncToken token,
 
         final SyncResultsHandler handlerChain = handler;
         final AtomicReference<SyncToken> result = new AtomicReference<SyncToken>(null);
-        final Boolean doAll = ObjectClass.ALL.equals(objectClass);
+        final boolean doAll = ObjectClass.ALL.equals(objectClass);
         // SyncTokenResultsHandler handlerChain =
         ((SyncOp) getConnector()).sync(objectClass, token, new SyncTokenResultsHandler() {
 

OpenICF-java-framework/connector-framework-internal/src/main/java/org/identityconnectors/framework/impl/api/remote/RemoteWrappedException.java

@@ -162,7 +162,7 @@ public boolean is(Class<? extends Throwable> expected) {
      */
     @Override
     @SuppressWarnings("unchecked")
-    public RemoteWrappedException getCause() {
+    public synchronized RemoteWrappedException getCause() {
         Object o = exception.get(FIELD_CAUSE);
         if (o instanceof Map) {
             return new RemoteWrappedException((Map<String, Object>) o);

OpenICF-java-framework/connector-framework-server/src/main/java/org/forgerock/openicf/framework/async/impl/BatchApiOpImpl.java

@@ -374,7 +374,8 @@
         private class CompletionListener extends Thread {
             private final AtomicBoolean running = new AtomicBoolean(false);
 
-            public void start() {
+            @Override
+            public synchronized void start() {
                 // The token and "complete" responses are dispatched on pool threads and may
                 // race here; only the first caller may actually start the thread.
                 if (!running.compareAndSet(false, true)) {
@@ -563,7 +564,7 @@
                         CreateOpRequest req = task.getCreateRequest();
                         tasks.add(new CreateBatchTask(
                                 new ObjectClass(req.getObjectClass()),
                                 (Set<Attribute>) MessagesUtil.deserializeLegacy(req.getCreateAttributes()),
                                 (OperationOptions) MessagesUtil.deserializeLegacy(req.getOptions())
                         ));
                     } else if (task.hasDeleteRequest()) {

OpenICF-java-framework/connector-framework-server/src/main/java/org/forgerock/openicf/framework/client/ClientRemoteConnectorInfoManager.java

@@ -530,7 +530,7 @@ private class ICFWebSocket extends SimpleWebSocket {
         protected final PromiseImpl<WebSocketConnectionHolder, RuntimeException> connectPromise =
                 PromiseImpl.create();
 
-        protected final Queue<OperationMessageListener> listeners =
+        protected final Queue<OperationMessageListener> messageListeners =
                 new ConcurrentLinkedQueue<OperationMessageListener>();
 
         // Written on the handshake-processing pool thread, read by other message
@@ -607,11 +607,11 @@ protected void tryClose() {
         }
 
         final boolean add(final OperationMessageListener listener) {
-            return listeners.add(listener);
+            return messageListeners.add(listener);
         }
 
         final boolean remove(final OperationMessageListener listener) {
-            return listeners.remove(listener);
+            return messageListeners.remove(listener);
         }
 
         public void onClose(DataFrame frame) {
@@ -622,7 +622,7 @@ public void onClose(DataFrame frame) {
                     + closing.getCode() + " - " + closing.getReason()));
             OperationMessageListener listener;
             try {
-                while ((listener = listeners.poll()) != null) {
+                while ((listener = messageListeners.poll()) != null) {
                     listener.onClose(adapter, closing.getCode(), closing.getReason());
                 }
             } finally {
@@ -634,35 +634,35 @@ public void onClose(DataFrame frame) {
 
         public void onConnect() {
             super.onConnect();
-            for (OperationMessageListener listener : listeners) {
+            for (OperationMessageListener listener : messageListeners) {
                 listener.onConnect(adapter);
             }
         }
 
         public void onMessage(byte[] data) {
             super.onMessage(data);
-            for (OperationMessageListener listener : listeners) {
+            for (OperationMessageListener listener : messageListeners) {
                 listener.onMessage(adapter, data);
             }
         }
 
         public void onMessage(String text) {
             super.onMessage(text);
-            for (OperationMessageListener listener : listeners) {
+            for (OperationMessageListener listener : messageListeners) {
                 listener.onMessage(adapter, text);
             }
         }
 
         public void onPing(DataFrame frame) {
             super.onPing(frame);
-            for (OperationMessageListener listener : listeners) {
+            for (OperationMessageListener listener : messageListeners) {
                 listener.onPing(adapter, frame.getBytes());
             }
         }
 
         public void onPong(DataFrame frame) {
             super.onPong(frame);
-            for (OperationMessageListener listener : listeners) {
+            for (OperationMessageListener listener : messageListeners) {
                 listener.onPong(adapter, frame.getBytes());
             }
         }