Fix CodeQL error-level findings: dead branches, log arguments, locking, clone

openidm-cluster/src/main/java/org/forgerock/openidm/cluster/ClusterManager.java

@@ -12,7 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Portions copyright 2013-2016 ForgeRock AS.
- * Portions Copyrighted 2024 3A Systems LLC.
+ * Portions Copyrighted 2024-2026 3A Systems LLC.
  */
 package org.forgerock.openidm.cluster;
 
@@ -530,7 +530,7 @@ private void checkOut() {
                 // just update the timestamp
                 state.setState(InstanceState.STATE_DOWN);
                 updateInstanceState(instanceId, state);
-                logger.debug("Instance {} state updated successfully");
+                logger.debug("Instance {} state updated successfully", instanceId);
                 break;
             case InstanceState.STATE_DOWN:
                 // Already down

openidm-core/src/main/java/org/forgerock/openidm/sync/impl/ReconciliationService.java

@@ -12,7 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Portions copyright 2012-2015 ForgeRock AS.
- * Portions Copyrighted 2024 3A Systems LLC.
+ * Portions Copyrighted 2024-2026 3A Systems LLC.
  */
 package org.forgerock.openidm.sync.impl;
 
@@ -31,7 +31,6 @@
 import java.util.Map;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
-import java.util.concurrent.ScheduledThreadPoolExecutor;
 import java.util.concurrent.ThreadPoolExecutor;
 
 import javax.management.MBeanServer;
@@ -529,8 +528,6 @@ public ExecutorService getThreadPool() {
     public int getActiveThreads() throws ResourceException {
         if (fullReconExecutor instanceof ThreadPoolExecutor) {
             return ((ThreadPoolExecutor) fullReconExecutor).getActiveCount();
-        } else if (fullReconExecutor instanceof ScheduledThreadPoolExecutor) {
-            return ((ScheduledThreadPoolExecutor) fullReconExecutor).getActiveCount();
         } else {
             logger.error("Unable to get the number of active threads in recon thread pool");
             throw new InternalServerErrorException("Unable to get the number of active threads in recon thread pool");
@@ -544,8 +541,6 @@ public int getActiveThreads() throws ResourceException {
     public int getCorePoolSize() throws ResourceException {
         if (fullReconExecutor instanceof ThreadPoolExecutor) {
             return ((ThreadPoolExecutor) fullReconExecutor).getCorePoolSize();
-        } else if (fullReconExecutor instanceof ScheduledThreadPoolExecutor) {
-            return ((ScheduledThreadPoolExecutor) fullReconExecutor).getCorePoolSize();
         } else {
             logger.error("Unable to get the core pool size in recon thread pool");
             throw new InternalServerErrorException("Unable to get the core pool size in recon thread pool");
@@ -559,8 +554,6 @@ public int getCorePoolSize() throws ResourceException {
     public int getPoolSize() throws ResourceException {
         if (fullReconExecutor instanceof ThreadPoolExecutor) {
             return ((ThreadPoolExecutor) fullReconExecutor).getPoolSize();
-        } else if (fullReconExecutor instanceof ScheduledThreadPoolExecutor) {
-            return ((ScheduledThreadPoolExecutor) fullReconExecutor).getPoolSize();
         } else {
             logger.error("Unable to get the pool size in recon thread pool");
             throw new InternalServerErrorException("Unable to get the pool size in recon thread pool");
@@ -574,8 +567,6 @@ public int getPoolSize() throws ResourceException {
     public int getLargestPoolSize() throws ResourceException {
         if (fullReconExecutor instanceof ThreadPoolExecutor) {
             return ((ThreadPoolExecutor) fullReconExecutor).getLargestPoolSize();
-        } else if (fullReconExecutor instanceof ScheduledThreadPoolExecutor) {
-            return ((ScheduledThreadPoolExecutor) fullReconExecutor).getLargestPoolSize();
         } else {
             logger.error("Unable to get the largest pool size in recon thread pool");
             throw new InternalServerErrorException("Unable to get the largest pool size in recon thread pool");
@@ -589,8 +580,6 @@ public int getLargestPoolSize() throws ResourceException {
     public int getMaximumPoolSize() throws ResourceException {
         if (fullReconExecutor instanceof ThreadPoolExecutor) {
             return ((ThreadPoolExecutor) fullReconExecutor).getMaximumPoolSize();
-        } else if (fullReconExecutor instanceof ScheduledThreadPoolExecutor) {
-            return ((ScheduledThreadPoolExecutor) fullReconExecutor).getMaximumPoolSize();
         } else {
             logger.error("Unable to get the maximum pool size in recon thread pool");
             throw new InternalServerErrorException("Unable to get the maximum pool size in recon thread pool");

openidm-maintenance/src/main/java/org/forgerock/openidm/maintenance/upgrade/ChecksumFile.java

@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2015 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.forgerock.openidm.maintenance.upgrade;
 
@@ -98,6 +99,15 @@ Path resolvePath(Path file) {
         return checksums.getParent().resolve(file);
     }
 
+    /**
+     * Shallow copy: the entries are copied, the checksum file path and the {@link MessageDigest}
+     * are shared with the original (the digest resets itself after every {@code digest()} call).
+     */
+    @Override
+    public ChecksumFile clone() {
+        return (ChecksumFile) super.clone();
+    }
+
     private String computeDigest(byte[] data) {
         return hexAdapter.marshal(digest.digest(data));
     }

openidm-maintenance/src/test/java/org/forgerock/openidm/maintenance/upgrade/ChecksumFileTest.java

@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2015-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.forgerock.openidm.maintenance.upgrade;
 
@@ -51,6 +52,17 @@ public void testChecksumFileNoSuchAlgorithm() throws IOException, NoSuchAlgorith
         new ChecksumFile(Paths.get(getClass().getResource("/unknownalgorithm.csv").toURI()));
     }
 
+    @Test
+    public void testCloneKeepsEntriesAndType() throws URISyntaxException, IOException, NoSuchAlgorithmException {
+        ChecksumFile original = new ChecksumFile(Paths.get(getClass().getResource("/checksums.csv").toURI()));
+
+        ChecksumFile copy = original.clone();
+
+        assertThat(copy).isNotSameAs(original);
+        assertThat(copy).isEqualTo(original);
+        assertThat(copy.resolvePath(Paths.get("file1"))).isEqualTo(original.resolvePath(Paths.get("file1")));
+    }
+
     @Test
     public void testGetFiles() throws URISyntaxException, IOException, NoSuchAlgorithmException {
         Set<Path> files = new ChecksumFile(Paths.get(getClass().getResource("/checksums.csv").toURI())).getFilePaths();

openidm-provisioner-openicf/src/main/java/org/forgerock/openidm/provisioner/openicf/impl/ConnectorInfoProviderService.java

@@ -738,8 +738,8 @@ public void handleResult(ConnectorInfo connectorInfo) {
                         }
                         properties = ci.createDefaultAPIConfiguration().getConfigurationProperties();
                     } catch (RuntimeException e) {
-                        logger.error("Failed to parse the config of {}-{}: {}", new Object[] {
-                                pidOrFactory, instanceAlias, e.getMessage()}, e);
+                        logger.error("Failed to parse the config of {}-{}: {}",
+                                pidOrFactory, instanceAlias, e.getMessage(), e);
                         throw e;
                     }
 

openidm-provisioner-openicf/src/main/java/org/forgerock/openidm/provisioner/openicf/impl/OperationHelperImpl.java

@@ -42,7 +42,6 @@
 
 import java.lang.reflect.UndeclaredThrowableException;
 import java.net.URI;
-import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
 
@@ -54,7 +53,6 @@ public class OperationHelperImpl implements OperationHelper {
 
     private final ObjectClassInfoHelper objectClassInfoHelper;
     private final Map<Class<? extends APIOperation>, OperationOptionInfoHelper> operations;
-    private final List<Map<String, Object>> resultList = new ArrayList<Map<String, Object>>();
     private final Id systemObjectSetId;
     private final CryptoService cryptoService;
 

openidm-provisioner/src/main/java/org/forgerock/openidm/provisioner/Id.java

@@ -170,7 +170,7 @@ public Id expectObjectId() throws ResourceException {
         if (StringUtils.isBlank(localId)) {
             ResourceException ex = new BadRequestException("This id instance does not qualified to identify a single unique object");
             TRACE.error("Unqualified id: systemName={}, objectType={}, localId={}",
-                    new Object[] { systemName, objectType, localId }, ex);
+                    systemName, objectType, localId, ex);
             throw ex;
         }
         return this;

openidm-quartz-fragment/src/main/java/org/forgerock/openidm/quartz/impl/RepoJobStore.java

@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2012-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.forgerock.openidm.quartz.impl;
 
@@ -134,11 +135,6 @@ public class RepoJobStore implements JobStore, ClusterEventListener {
      */
     private int writeRetries = -1;
 
-    /**
-     * A list of all "blocked" jobs.
-     */
-    private List<String> blockedJobs = new ArrayList<>();
-
     /**
      * An AtomicLong used for creating record IDs
      */
@@ -1367,7 +1363,6 @@ public TriggerFiredBundle triggerFired(SchedulingContext context, Trigger trigge
                         removeWaitingTrigger(t);
                     }
                 }
-                blockedJobs.add(getJobNameKey(job));
             } else if (localTrigger.getNextFireTime() != null) {
                 addWaitingTrigger(localTrigger);
             }
@@ -1409,7 +1404,6 @@ public void triggeredJobComplete(SchedulingContext context, Trigger trigger,
                         newData.clearDirtyFlag();
                     }
                     jd.setJobDataMap(newData);
-                    blockedJobs.remove(getJobNameKey(jd));
                     Trigger[] triggers = getTriggersForJob(context, jd.getName(), jd.getGroup());
                     for (Trigger t : triggers) {
                         TriggerWrapper tmpTw = getTriggerWrapper(t.getGroup(), t.getName());
@@ -1428,8 +1422,6 @@ public void triggeredJobComplete(SchedulingContext context, Trigger trigger,
                     }
                     schedulerSignaler.signalSchedulingChange(0L);
                 }
-            } else {
-                blockedJobs.remove(jobKey);
             }
 
             if (tw != null) {

openidm-repo-jdbc/src/main/java/org/forgerock/openidm/repo/jdbc/impl/ExplicitResultSetMapper.java

@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.forgerock.openidm.repo.jdbc.impl;
 
@@ -116,7 +117,7 @@ public JsonValue mapToJsonValue(ResultSet rs, Set<String> columnNames) throws SQ
                 mappedResult.putPermissive(entry.objectColPointer, value);
             }
         }
-        if (columnNames.contains("total") && !columnMappings.contains("total")) {
+        if (columnNames.contains("total") && !isMappedDbColumn("total")) {
             mappedResult.putPermissive(pathToTotal, rs.getInt("total"));
         }
         logger.debug("Mapped rs {} to {}", rs, mappedResult);
@@ -164,6 +165,15 @@ public String getDbColumnName(JsonPointer fieldName) {
         throw new IllegalArgumentException("Unknown object field: " + fieldName.toString());
     }
 
+    private boolean isMappedDbColumn(String dbColName) {
+        for (ColumnMapping mapping : columnMappings) {
+            if (dbColName.equals(mapping.dbColName)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     /**
      * @return the columnMappings
      */

openidm-repo-jdbc/src/main/java/org/forgerock/openidm/repo/jdbc/impl/GenericTableHandler.java

@@ -598,7 +598,7 @@ public void delete(String fullId, String type, String localId, String rev, Conne
             logger.debug("Delete statement: {}", deleteStatement);
 
             int deletedRows = deleteStatement.executeUpdate();
-            logger.trace("Deleted {} rows for id : {} {}", deletedRows, localId);
+            logger.trace("Deleted {} rows for id : {}", deletedRows, localId);
             if (deletedRows < 1) {
                 throw new InternalServerErrorException("Deleting object for " + fullId + " failed, DB reported " + deletedRows + " rows deleted");
             } else {

openidm-repo-jdbc/src/main/java/org/forgerock/openidm/repo/jdbc/impl/MappedTableHandler.java

@@ -170,7 +170,7 @@ protected void initializeQueries() {
         deleteQueryStr = "DELETE FROM " + mainTable + " WHERE objectid = ? AND rev = ?";
 
         logger.debug("Unprepared query strings {} {} {} {} {}",
-                readQueryStr, createQueryStr, updateQueryStr, deleteQueryStr);
+                readQueryStr, readForUpdateQueryStr, createQueryStr, updateQueryStr, deleteQueryStr);
 
     }
 
@@ -452,7 +452,7 @@ public void delete(String fullId, String type, String localId, String rev, Conne
             logger.debug("Delete statement: {}", deleteStatement);
 
             int deletedRows = deleteStatement.executeUpdate();
-            logger.trace("Deleted {} rows for id : {} {}", deletedRows, localId);
+            logger.trace("Deleted {} rows for id : {}", deletedRows, localId);
             if (deletedRows < 1) {
                 throw new InternalServerErrorException("Deleting object for " + fullId
                         + " failed, DB reported " + deletedRows + " rows deleted");

openidm-repo-jdbc/src/main/java/org/forgerock/openidm/repo/jdbc/impl/PostgreSQLMappedTableHandler.java

@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2015 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.forgerock.openidm.repo.jdbc.impl;
 
@@ -73,6 +74,6 @@ protected void initializeQueries() {
         deleteQueryStr = "DELETE FROM " + mainTable + " WHERE objectid = ? AND rev = ?";
 
         logger.debug("Unprepared query strings {} {} {} {} {}",
-                readQueryStr, createQueryStr, updateQueryStr, deleteQueryStr);
+                readQueryStr, readForUpdateQueryStr, createQueryStr, updateQueryStr, deleteQueryStr);
     }
 }

openidm-repo-jdbc/src/test/java/org/forgerock/openidm/repo/jdbc/impl/ExplicitResultSetMapperTest.java

@@ -0,0 +1,79 @@
+/*
+ * The contents of this file are subject to the terms of the Common Development and
+ * Distribution License (the License). You may not use this file except in compliance with the
+ * License.
+ *
+ * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+ * specific language governing permission and limitations under the License.
+ *
+ * When distributing Covered Software, include this CDDL Header Notice in each file and include
+ * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+ * Header, with the fields enclosed by brackets [] replaced by your own identifying
+ * information: "Portions copyright [year] [name of copyright owner]".
+ *
+ * Copyright 2026 3A Systems, LLC.
+ */
+package org.forgerock.openidm.repo.jdbc.impl;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.forgerock.json.JsonValue.array;
+import static org.forgerock.json.JsonValue.field;
+import static org.forgerock.json.JsonValue.json;
+import static org.forgerock.json.JsonValue.object;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.sql.ResultSet;
+import java.util.Arrays;
+import java.util.HashSet;
+
+import org.forgerock.json.JsonValue;
+import org.forgerock.openidm.crypto.CryptoService;
+import org.forgerock.openidm.util.Accessor;
+import org.testng.annotations.Test;
+
+/**
+ * Tests for {@link ExplicitResultSetMapper#mapToJsonValue}.
+ */
+public class ExplicitResultSetMapperTest {
+
+    /** STRING columns require a crypto service to be reachable, even when nothing is encrypted. */
+    private static final Accessor<CryptoService> CRYPTO = new Accessor<CryptoService>() {
+        private final CryptoService cryptoService = mock(CryptoService.class);
+
+        @Override
+        public CryptoService access() {
+            return cryptoService;
+        }
+    };
+
+    @Test
+    public void unmappedTotalColumnIsExposedAsRowCount() throws Exception {
+        ExplicitResultSetMapper mapper = new ExplicitResultSetMapper("t",
+                json(object(field("_id", "objectid"))), CRYPTO);
+        ResultSet rs = mock(ResultSet.class);
+        when(rs.getString("objectid")).thenReturn("1");
+        when(rs.getInt("total")).thenReturn(42);
+
+        JsonValue result = mapper.mapToJsonValue(rs, new HashSet<>(Arrays.asList("objectid", "total")));
+
+        assertThat(result.get("_id").asString()).isEqualTo("1");
+        assertThat(result.get("total").asInteger()).isEqualTo(42);
+    }
+
+    @Test
+    public void explicitlyMappedTotalColumnIsNotOverwrittenByRowCount() throws Exception {
+        ExplicitResultSetMapper mapper = new ExplicitResultSetMapper("t",
+                json(object(field("_id", "objectid"), field("total", array("total", "STRING")))), CRYPTO);
+        ResultSet rs = mock(ResultSet.class);
+        when(rs.getString("objectid")).thenReturn("1");
+        when(rs.getString("total")).thenReturn("mapped");
+
+        JsonValue result = mapper.mapToJsonValue(rs, new HashSet<>(Arrays.asList("objectid", "total")));
+
+        assertThat(result.get("total").asString()).isEqualTo("mapped");
+        verify(rs, never()).getInt("total");
+    }
+}