binance / binance/binance-connector-java

[Security] PrivateKey.getSigner() Returns Null for Unsupported Key Types

Open
#224 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
581
Forks
255
Avg merge
2m
Merged PRs (30d)
2

Description

## Bug Name
PrivateKey.getSigner() Returns Null for Unsupported Key Types

## Attack Scenario
getSigner() returns null for ECDSA or other unsupported key types. This null is stored in this.signer. Next call to sign() throws NullPointerException with no indication of the actual problem.

## Impact
Users with ECDSA keys get opaque NullPointerExceptions instead of a clear unsupported key type message.

## Components
File: clients/common/src/main/java/com/binance/connector/client/common/sign/PrivateKey.java line 132. Returns null for non-Ed25519/non-RSA keys.

## Reproduction
1. Configure client with an ECDSA private key.
2. Make a signed request.
3. NullPointerException thrown at sign() with no useful error message.

## Fix
Throw ApiException('Unsupported key type: ' + algorithmIdentifier) instead of returning null.

## Details
Finding ID: MEDIUM-02
Severity: Medium

---
Researcher: Independent Security Researcher -- Mefai Security Team

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.