From 2600160e599bf2a17d5ae503606985049eb6051d Mon Sep 17 00:00:00 2001
From: Derek Ho <dxho@amazon.com>
Date: Mon, 16 Dec 2024 15:11:32 -0500
Subject: [PATCH] Handle null parsing in util

Signed-off-by: Derek Ho <dxho@amazon.com>
---
 .../security/action/apitokens/ApiTokenAction.java        | 9 ---------
 .../java/org/opensearch/security/util/ParsingUtils.java  | 7 +++++++
 .../org/opensearch/security/util/ParsingUtilsTest.java   | 8 +++++++-
 3 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/src/main/java/org/opensearch/security/action/apitokens/ApiTokenAction.java b/src/main/java/org/opensearch/security/action/apitokens/ApiTokenAction.java
index 31a8b5751c..a9dd54e80b 100644
--- a/src/main/java/org/opensearch/security/action/apitokens/ApiTokenAction.java
+++ b/src/main/java/org/opensearch/security/action/apitokens/ApiTokenAction.java
@@ -146,10 +146,6 @@ private RestChannelConsumer handlePost(RestRequest request, NodeClient client) {
      * Extracts cluster permissions from the request body
      */
     List<String> extractClusterPermissions(Map<String, Object> requestBody) {
-        if (!requestBody.containsKey(CLUSTER_PERMISSIONS_FIELD)) {
-            return Collections.emptyList();
-        }
-
         return ParsingUtils.safeStringList(requestBody.get(CLUSTER_PERMISSIONS_FIELD), CLUSTER_PERMISSIONS_FIELD);
     }
 
@@ -157,12 +153,7 @@ List<String> extractClusterPermissions(Map<String, Object> requestBody) {
      * Extracts and builds index permissions from the request body
      */
     List<ApiToken.IndexPermission> extractIndexPermissions(Map<String, Object> requestBody) {
-        if (!requestBody.containsKey(INDEX_PERMISSIONS_FIELD)) {
-            return Collections.emptyList();
-        }
-
         List<Map<String, Object>> indexPerms = ParsingUtils.safeMapList(requestBody.get(INDEX_PERMISSIONS_FIELD), INDEX_PERMISSIONS_FIELD);
-
         return indexPerms.stream().map(this::createIndexPermission).collect(Collectors.toList());
     }
 
diff --git a/src/main/java/org/opensearch/security/util/ParsingUtils.java b/src/main/java/org/opensearch/security/util/ParsingUtils.java
index 8dbc6b5df2..1a33ec46b4 100644
--- a/src/main/java/org/opensearch/security/util/ParsingUtils.java
+++ b/src/main/java/org/opensearch/security/util/ParsingUtils.java
@@ -11,6 +11,7 @@
 
 package org.opensearch.security.util;
 
+import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.stream.Collectors;
@@ -21,6 +22,9 @@ public class ParsingUtils {
      * Safely casts an Object to List<String> with validation
      */
     public static List<String> safeStringList(Object obj, String fieldName) {
+        if (obj == null) {
+            return Collections.emptyList();
+        }
         if (!(obj instanceof List<?> list)) {
             throw new IllegalArgumentException(fieldName + " must be an array");
         }
@@ -39,6 +43,9 @@ public static List<String> safeStringList(Object obj, String fieldName) {
      */
     @SuppressWarnings("unchecked")
     public static List<Map<String, Object>> safeMapList(Object obj, String fieldName) {
+        if (obj == null) {
+            return Collections.emptyList();
+        }
         if (!(obj instanceof List<?> list)) {
             throw new IllegalArgumentException(fieldName + " must be an array");
         }
diff --git a/src/test/java/org/opensearch/security/util/ParsingUtilsTest.java b/src/test/java/org/opensearch/security/util/ParsingUtilsTest.java
index 9c944b84b7..8e92ce3a39 100644
--- a/src/test/java/org/opensearch/security/util/ParsingUtilsTest.java
+++ b/src/test/java/org/opensearch/security/util/ParsingUtilsTest.java
@@ -12,6 +12,7 @@
 package org.opensearch.security.util;
 
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -28,6 +29,9 @@ public class ParsingUtilsTest {
 
     @Test
     public void testSafeStringList() {
+        List<String> emptyResult = safeStringList(null, "test_field");
+        assertThat(emptyResult, is(Collections.emptyList()));
+
         List<String> result = safeStringList(Arrays.asList("test1", "test2"), "test_field");
         assertThat(result, is(Arrays.asList("test1", "test2")));
 
@@ -40,7 +44,9 @@ public void testSafeStringList() {
 
     @Test
     public void testSafeMapList() {
-        // Test valid map list
+        List<Map<String, Object>> emptyResult = safeMapList(null, "test_field");
+        assertThat(emptyResult, is(Collections.emptyList()));
+
         Map<String, Object> map1 = new HashMap<>();
         map1.put("key1", "value1");
         map1.put("key2", 123);