Handle uncaught NumberFormatException at 20 parse sites (CodeQL java/uncaught-number-format-exception)

commons/audit/core/src/main/java/org/forgerock/audit/events/handlers/writers/AsynchronousTextWriter.java

@@ -13,6 +13,7 @@
  *
  *      Copyright 2006-2008 Sun Microsystems, Inc.
  *      Portions Copyright 2013-2015 ForgeRock AS.
+ *      Portions Copyrighted 2026 3A Systems, LLC
  */
 package org.forgerock.audit.events.handlers.writers;
 
@@ -42,8 +43,24 @@
 public class AsynchronousTextWriter implements TextWriter {
 
     private static final Logger logger = LoggerFactory.getLogger(AsynchronousTextWriter.class);
+    /** System property overriding the default queue capacity. */
+    private static final String CAPACITY_PROPERTY =
+            "org.forgerock.audit.events.handlers.writers.AsynchronousTextWriter.CAPACITY";
+    /** Default queue capacity used when {@link #CAPACITY_PROPERTY} is unset or invalid. */
+    private static final int DEFAULT_CAPACITY = 32000;
     /** Maximum number of messages that can be queued before producers start to block. */
-    private static final int CAPACITY = Integer.parseInt(System.getProperty("org.forgerock.audit.events.handlers.writers.AsynchronousTextWriter.CAPACITY","32000"));
+    private static final int CAPACITY = readCapacity();
+
+    private static int readCapacity() {
+        final String value = System.getProperty(CAPACITY_PROPERTY, String.valueOf(DEFAULT_CAPACITY));
+        try {
+            return Integer.parseInt(value);
+        } catch (final NumberFormatException e) {
+            logger.warn("Invalid value '{}' for system property {}; using default {}.",
+                    value, CAPACITY_PROPERTY, DEFAULT_CAPACITY);
+            return DEFAULT_CAPACITY;
+        }
+    }
 
     /** The wrapped Text Writer. */
     private final TextWriter writer;

commons/audit/handler-elasticsearch/src/main/java/org/forgerock/audit/handlers/elasticsearch/ElasticsearchAuditEventHandler.java

@@ -54,6 +54,7 @@
 import org.forgerock.http.protocol.Responses;
 import org.forgerock.http.spi.Loader;
 import org.forgerock.json.JsonValue;
+import org.forgerock.json.resource.BadRequestException;
 import org.forgerock.json.resource.CountPolicy;
 import org.forgerock.json.resource.InternalServerErrorException;
 import org.forgerock.json.resource.NotFoundException;
@@ -199,7 +200,11 @@ public Promise<QueryResponse, ResourceException> queryEvents(final Context conte
         if (query.getPagedResultsOffset() != 0) {
             offset = query.getPagedResultsOffset();
         } else if (query.getPagedResultsCookie() != null) {
-            offset = Integer.valueOf(query.getPagedResultsCookie());
+            try {
+                offset = Integer.parseInt(query.getPagedResultsCookie());
+            } catch (final NumberFormatException e) {
+                return new BadRequestException("Invalid paged results cookie", e).asPromise();
+            }
         } else {
             offset = DEFAULT_OFFSET;
         }

commons/auth-filters/authn-filter/jaspi-modules/jwt-session-module/src/main/java/org/forgerock/jaspi/modules/session/jwt/AbstractJwtSessionModule.java

@@ -168,9 +168,9 @@ public void initialize(CallbackHandler handler, Map options) throws Authenticati
             throw new AuthenticationException("Can't use both " + TOKEN_IDLE_TIME_IN_MINUTES_CLAIM_KEY
                     + " setting and the " + TOKEN_IDLE_TIME_IN_SECONDS_CLAIM_KEY + " setting.");
         } else if (!isEmpty(tokenIdleTimeMinutes)) {
-            this.tokenIdleTime = Integer.parseInt(tokenIdleTimeMinutes) * 60;
+            this.tokenIdleTime = parseIntSetting(TOKEN_IDLE_TIME_IN_MINUTES_CLAIM_KEY, tokenIdleTimeMinutes) * 60;
         } else if (!isEmpty(tokenIdleTimeSeconds)) {
-            this.tokenIdleTime = Integer.parseInt(tokenIdleTimeSeconds);
+            this.tokenIdleTime = parseIntSetting(TOKEN_IDLE_TIME_IN_SECONDS_CLAIM_KEY, tokenIdleTimeSeconds);
         } else {
             this.tokenIdleTime = 0;
         }
@@ -180,9 +180,9 @@ public void initialize(CallbackHandler handler, Map options) throws Authenticati
             throw new AuthenticationException("Can't use both the " + MAX_TOKEN_LIFE_IN_MINUTES_KEY
                     + " setting and the " + MAX_TOKEN_LIFE_IN_SECONDS_KEY + " setting.");
         } else if (!isEmpty(maxTokenLifeMinutes)) {
-            this.maxTokenLife = Integer.parseInt(maxTokenLifeMinutes) * 60;
+            this.maxTokenLife = parseIntSetting(MAX_TOKEN_LIFE_IN_MINUTES_KEY, maxTokenLifeMinutes) * 60;
         } else if (!isEmpty(maxTokenLifeSeconds)) {
-            this.maxTokenLife = Integer.parseInt(maxTokenLifeSeconds);
+            this.maxTokenLife = parseIntSetting(MAX_TOKEN_LIFE_IN_SECONDS_KEY, maxTokenLifeSeconds);
         } else {
             this.maxTokenLife = 0;
         }
@@ -204,6 +204,14 @@ public void initialize(CallbackHandler handler, Map options) throws Authenticati
         Arrays.fill(signingKey, (byte) 0);
     }
 
+    private static int parseIntSetting(final String settingName, final String value) throws AuthenticationException {
+        try {
+            return Integer.parseInt(value);
+        } catch (final NumberFormatException e) {
+            throw new AuthenticationException("The " + settingName + " setting must be an integer, but was: " + value);
+        }
+    }
+
     /**
      * Checks for the presence of the JWT as a Cookie on the request and validates the signature and decrypts it and
      * checks the expiration time of the JWT. If all these checks pass then the method return AuthStatus.SUCCESS,

commons/http-framework/core/src/main/java/org/forgerock/http/header/Warning.java

@@ -12,6 +12,7 @@
  * information: "Portions Copyright [year] [name of copyright owner]".
  *
  * Copyright 2016 ForgeRock AS.
+ * Portions Copyrighted 2026 3A Systems, LLC
  */
 
 package org.forgerock.http.header;
@@ -150,7 +151,12 @@ public int hashCode() {
     public static Warning valueOf(final String value) {
         final Matcher m = PATTERN.matcher(value);
         if (m.matches()) {
-            final int code = Integer.parseInt(m.group(1));
+            final int code;
+            try {
+                code = Integer.parseInt(m.group(1));
+            } catch (final NumberFormatException e) {
+                return null;
+            }
             final String agent = m.group(2);
             final String tail = m.group(3);
             final String text;

commons/json-web-token/src/main/java/org/forgerock/json/jose/jwt/JwtClaimsSet.java

@@ -27,6 +27,7 @@
 import java.util.Map;
 
 import org.forgerock.json.JsonValue;
+import org.forgerock.json.jose.exceptions.JwtRuntimeException;
 import org.forgerock.json.jose.utils.IntDate;
 import org.forgerock.json.jose.utils.StringOrURI;
 
@@ -397,7 +398,11 @@ public void setClaim(String key, Object value) {
             if (isValueOfType(value, Number.class)) {
                 setExpirationTime(((Number) value).longValue());
             } else if (isValueOfType(value, String.class)) {
-            	setExpirationTime(Long.parseLong((String)value));
+                try {
+                    setExpirationTime(Long.parseLong((String) value));
+                } catch (final NumberFormatException e) {
+                    throw new JwtRuntimeException("Expiration time claim (exp) is not a valid number: " + value, e);
+                }
             } else {
                 checkValueIsOfType(value, Date.class);
                 setExpirationTime((Date) value);

commons/rest/api-descriptor/src/main/java/org/forgerock/api/jackson/CrestIntegerSchema.java

@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2016 ForgeRock AS.
+ * Portions Copyrighted 2026 3A Systems, LLC
  */
 
 package org.forgerock.api.jackson;
@@ -194,6 +195,10 @@ public Long getExample() {
 
     @Override
     public void setExample(String example) {
-        this.example = Long.valueOf(example);
+        try {
+            this.example = Long.valueOf(example);
+        } catch (final NumberFormatException e) {
+            throw new ValidationException("Example value is not a valid integer: " + example);
+        }
     }
 }

commons/rest/json-resource/src/main/java/org/forgerock/json/resource/MemoryBackend.java

@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2012-2015 ForgeRock AS.
+ * Portions Copyrighted 2026 3A Systems, LLC
  */
 
 package org.forgerock.json.resource;
@@ -68,10 +69,15 @@ private static final class Cookie {
             this.lastResultIndex = lastResultIndex;
         }
 
-        static Cookie valueOf(String base64) {
+        static Cookie valueOf(String base64) throws ResourceException {
             final String decoded = new String(Base64.decode(base64));
             final String[] split = decoded.split(":");
-            final int lastOffset = Integer.parseInt(split[0]);
+            final int lastOffset;
+            try {
+                lastOffset = Integer.parseInt(split[0]);
+            } catch (final NumberFormatException e) {
+                throw new BadRequestException("Invalid paged results cookie", e);
+            }
             final List<SortKey> sortKeys = new ArrayList<>();
             final String[] splitKeys = split[1].split(",");
 
@@ -596,7 +602,11 @@ public Promise<QueryResponse, ResourceException> queryCollection(final Context c
                     return new BadRequestException("Cookies and offsets are mutually exclusive").asPromise();
                 }
 
-                firstResultIndex = Cookie.valueOf(pagedResultsCookie).getLastResultIndex();
+                try {
+                    firstResultIndex = Cookie.valueOf(pagedResultsCookie).getLastResultIndex();
+                } catch (final ResourceException e) {
+                    return e.asPromise();
+                }
             } else {
                 if (request.getPagedResultsOffset() > 0) {
                     firstResultIndex = request.getPagedResultsOffset();

commons/util/util/src/main/java/org/forgerock/util/query/QueryFilterParser.java

@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2015 ForgeRock AS.
+ * Portions Copyrighted 2026 3A Systems, LLC
  */
 
 package org.forgerock.util.query;
@@ -217,10 +218,18 @@ private QueryFilter<F> valueOfPrimaryExpr(final FilterTokenizer tokenizer, final
                     assertionValue = Boolean.parseBoolean(nextToken);
                 } else if (nextToken.indexOf('.') >= 0) {
                     // Floating point number.
-                    assertionValue = Double.parseDouble(nextToken);
+                    try {
+                        assertionValue = Double.parseDouble(nextToken);
+                    } catch (final NumberFormatException e) {
+                        return valueOfIllegalArgument(tokenizer);
+                    }
                 } else {
                     // Must be an integer.
-                    assertionValue = Long.parseLong(nextToken);
+                    try {
+                        assertionValue = Long.parseLong(nextToken);
+                    } catch (final NumberFormatException e) {
+                        return valueOfIllegalArgument(tokenizer);
+                    }
                 }
                 try {
                     return comparisonFilter(pointer, operator, assertionValue);

persistit/core/src/main/java/com/persistit/JournalManager.java

@@ -1,6 +1,7 @@
 /**
  * Copyright 2011-2012 Akiban Technologies, Inc.
  * Copyright 2015 ForgeRock AS
+ * Portions Copyrighted 2026 3A Systems, LLC.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -1261,7 +1262,11 @@ static File journalPath(final String path) {
     static long fileToGeneration(final File file) {
         final Matcher matcher = PATH_PATTERN.matcher(file.getName());
         if (matcher.matches()) {
-            return Long.parseLong(matcher.group(2));
+            try {
+                return Long.parseLong(matcher.group(2));
+            } catch (final NumberFormatException e) {
+                return -1;
+            }
         } else {
             return -1;
         }

persistit/core/src/main/java/com/persistit/KeyParser.java

@@ -1,5 +1,6 @@
 /**
  * Copyright 2005-2012 Akiban Technologies, Inc.
+ * Portions Copyrighted 2026 3A Systems, LLC.
  * 
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -535,7 +536,12 @@ else if (c == '\"') {
     private int unicode() {
         if (_index + 4 > _end)
             return -1;
-        final int u = Integer.parseInt(_source.substring(_index, _index + 4), 16);
+        final int u;
+        try {
+            u = Integer.parseInt(_source.substring(_index, _index + 4), 16);
+        } catch (final NumberFormatException e) {
+            return -1;
+        }
         _index += 4;
         return u;
     }

persistit/ui/src/main/java/com/persistit/ui/AdminUI.java

@@ -1,5 +1,6 @@
 /**
  * Copyright 2005-2012 Akiban Technologies, Inc.
+ * Portions Copyrighted 2026 3A Systems, LLC.
  * 
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -705,16 +706,16 @@ JComponent addLabeledField(final JPanel panel, final GridBagConstraints gbc, fin
         JComponent wrappedComponent = component;
         if (component instanceof JTextField) {
             final JTextField textField = (JTextField) component;
-            textField.setColumns(Integer.parseInt(widthStr));
+            textField.setColumns(parseDimension("width", widthStr));
             textField.setHorizontalAlignment(alignment.equals("R") ? SwingConstants.TRAILING
                     : alignment.equals("C") ? SwingConstants.CENTER : SwingConstants.LEADING);
             textField.setEditable(false);
             textField.setEnabled(true);
             textField.setBackground(Color.white);
         } else if (component instanceof JTextArea) {
             final JTextArea textArea = (JTextArea) component;
-            textArea.setColumns(Integer.parseInt(widthStr));
-            textArea.setRows(Integer.parseInt(heightStr));
+            textArea.setColumns(parseDimension("width", widthStr));
+            textArea.setRows(parseDimension("height", heightStr));
             textArea.setEditable(false);
             textArea.setEnabled(true);
             textArea.setBackground(Color.white);
@@ -736,6 +737,14 @@ JComponent addLabeledField(final JPanel panel, final GridBagConstraints gbc, fin
         return component;
     }
 
+    private static int parseDimension(final String name, final String value) {
+        try {
+            return Integer.parseInt(value);
+        } catch (final NumberFormatException e) {
+            throw new IllegalArgumentException("Invalid " + name + " in component specification: " + value, e);
+        }
+    }
+
     AdminAction createAction(final AdminCommand command, final String specification) {
         final StringTokenizer st = new StringTokenizer(specification, ":");
         String actionName = st.nextToken();

persistit/ui/src/main/java/com/persistit/ui/ManagementTableModel.java

@@ -113,13 +113,23 @@ protected void setup(final Class clazz, final String[] columnSpecs) throws NoSuc
         for (int index = 0; index < columnSpecs.length; index++) {
             final StringTokenizer st = new StringTokenizer(columnSpecs[index], ":");
             final String methodName = st.nextToken();
-            final int width = Integer.parseInt(st.nextToken());
+            final int width;
+            try {
+                width = Integer.parseInt(st.nextToken());
+            } catch (final NumberFormatException e) {
+                throw new IllegalArgumentException("Invalid width in column specification: " + columnSpecs[index], e);
+            }
             final String flags = st.nextToken();
             final String header = st.nextToken();
             String rendererName = null;
             int minWidth = width / 2;
             if (st.hasMoreTokens()) {
-                minWidth = Integer.parseInt(st.nextToken());
+                try {
+                    minWidth = Integer.parseInt(st.nextToken());
+                } catch (final NumberFormatException e) {
+                    throw new IllegalArgumentException(
+                            "Invalid minimum width in column specification: " + columnSpecs[index], e);
+                }
             }
             if (st.hasMoreTokens()) {
                 rendererName = st.nextToken();

script/javascript/src/main/java/org/forgerock/script/javascript/RhinoScriptEngine.java

@@ -18,7 +18,7 @@
  * "Portions Copyrighted [year] [name of copyright owner]"
  *
  * Copyright 2012-2016 ForgeRock AS.
- * Portions Copyrighted 2018-2025 3A Systems, LLC
+ * Portions Copyrighted 2018-2026 3A Systems, LLC
  */
 
 package org.forgerock.script.javascript;
@@ -96,8 +96,17 @@ public class RhinoScriptEngine extends AbstractScriptEngine {
         this.factory = factory;
         final JsonValue jsonValueConfig = new JsonValue(configuration);
         initDebugListener(jsonValueConfig.get(CONFIG_DEBUG_PROPERTY).defaultTo(null).asString());
-        minimumRecompilationInterval = Long.valueOf(
-                jsonValueConfig.get(CONFIG_RECOMPILE_MINIMUM_INTERVAL_PROPERTY).defaultTo("-1").asString());
+        final String recompileInterval =
+                jsonValueConfig.get(CONFIG_RECOMPILE_MINIMUM_INTERVAL_PROPERTY).defaultTo("-1").asString();
+        long minimumRecompilationIntervalValue;
+        try {
+            minimumRecompilationIntervalValue = Long.parseLong(recompileInterval);
+        } catch (final NumberFormatException e) {
+            logger.warn("Invalid {} configuration value '{}'; using default -1.",
+                    CONFIG_RECOMPILE_MINIMUM_INTERVAL_PROPERTY, recompileInterval);
+            minimumRecompilationIntervalValue = -1;
+        }
+        minimumRecompilationInterval = minimumRecompilationIntervalValue;
         scriptExceptionGenerator = jsonValueConfig.get(CONFIG_EXCEPTION_DEBUG_INFO).defaultTo(true).asBoolean()
                 ? DEBUG_SCRIPT_EXCEPTION_GENERATOR
                 : NON_DEBUG_SCRIPT_EXCEPTION_GENERATOR;