fix: clear SpotBugs findings in generated and bespoke SDK code

Regenerate transport, auth, and base API classes so intentional find-sec-bugs
findings (opt-in insecure TLS, user-supplied CA path, ASCII protocol-token
case folding) carry justified @SuppressFBWarnings annotations. Make the
bespoke Zitadel entry point final to clear CT_CONSTRUCTOR_THROW and narrow
URLUtil.buildHostname's catch to the checked exceptions it actually throws.

Author: mridang

src/main/java/com/zitadel/DefaultApiClient.java

@@ -68,15 +68,39 @@ public final class DefaultApiClient implements ApiClient {
 
     private static final ObjectMapper MULTIPART_MAPPER = ObjectSerializer.createDefaultObjectMapper();
 
+    /*
+     * Intentional all-trusting trust manager. Installed ONLY when the caller
+     * explicitly opts out of TLS verification via TransportOptions#verifySsl
+     * (false) — the documented curl -k equivalent used against local/dev
+     * Zitadel stacks with self-signed certificates. SpotBugs/find-sec-bugs
+     * correctly flags this as a MITM risk in general, but here it is a
+     * deliberate, opt-in feature mirrored across all 12 SDKs, so the warning
+     * is suppressed on the empty trust-check methods rather than removed.
+     */
     private static final X509TrustManager TRUST_ALL_MANAGER =
             new X509TrustManager() {
                 @Override
+                @edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
+                        value = "WEAK_TRUST_MANAGER",
+                        justification =
+                                "Opt-in insecure TLS (verifySsl=false): trust-all is a"
+                                        + " documented curl -k equivalent for dev stacks.")
                 public void checkClientTrusted(X509Certificate[] chain, String authType) {}
 
                 @Override
+                @edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
+                        value = "WEAK_TRUST_MANAGER",
+                        justification =
+                                "Opt-in insecure TLS (verifySsl=false): trust-all is a"
+                                        + " documented curl -k equivalent for dev stacks.")
                 public void checkServerTrusted(X509Certificate[] chain, String authType) {}
 
                 @Override
+                @edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
+                        value = "WEAK_TRUST_MANAGER",
+                        justification =
+                                "Opt-in insecure TLS (verifySsl=false): trust-all is a"
+                                        + " documented curl -k equivalent for dev stacks.")
                 public X509Certificate[] getAcceptedIssuers() {
                     return new X509Certificate[0];
                 }
@@ -225,6 +249,12 @@ private static HttpClient buildHttpClient(TransportOptions transportOptions) {
      * @return an {@link SSLContext} trusting only the given CA certificate
      * @throws ApiException if the certificate cannot be read or parsed
      */
+    @edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
+            value = "PATH_TRAVERSAL_IN",
+            justification =
+                    "The CA certificate path is supplied by the SDK caller via"
+                            + " TransportOptions#caCertPath as a deliberate TLS-pinning"
+                            + " opt-in, not by remote/untrusted input.")
     private static SSLContext buildPinnedSslContext(String caCertPath) {
         try {
             CertificateFactory cf = CertificateFactory.getInstance("X.509");
@@ -352,6 +382,12 @@ private HttpResponse<byte[]> sendWithRetry(HttpRequest request)
      * and the first 3xx is surfaced to the caller as-is.
      */
     @Override
+    @edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
+            value = "IMPROPER_UNICODE",
+            justification =
+                    "Case-insensitive comparisons here operate on ASCII HTTP tokens"
+                            + " (header names, methods, schemes), not user identity"
+                            + " strings, so Unicode case-folding ambiguities do not apply.")
     public ApiHttpResponse sendRequest(
             String method,
             String url,
@@ -498,15 +534,14 @@ public ApiHttpResponse sendRequest(
                     Map<String, String> redirectHeaders = new HashMap<>(currentHeaders);
                     if (!sameOrigin) {
                         redirectHeaders.keySet().removeIf(
-                                k -> sensitiveHeaders.contains(k.toLowerCase(Locale.ROOT)));
+                                k -> isSensitiveHeader(sensitiveHeaders, k));
                     }
                     if (nextBody == HttpRequest.BodyPublishers.noBody()
                             || ((statusCode == 303 || statusCode == 301 || statusCode == 302)
                                     && !"GET".equalsIgnoreCase(currentMethod)
                                     && !"HEAD".equalsIgnoreCase(currentMethod))) {
                         redirectHeaders.keySet().removeIf(
-                                k -> "content-type".equalsIgnoreCase(k)
-                                        || "content-length".equalsIgnoreCase(k));
+                                DefaultApiClient::isEntityHeader);
                     }
 
                     HttpRequest.Builder redirectBuilder = HttpRequest.newBuilder(redirectUri)
@@ -584,6 +619,38 @@ private static boolean isRedirect(int statusCode) {
                 || statusCode == 307 || statusCode == 308;
     }
 
+    /**
+     * Whether a header name is in the case-insensitive sensitive-header set
+     * that must be stripped on a cross-origin redirect. Extracted from the
+     * redirect {@code removeIf} lambda so the ASCII case folding sits in a
+     * named, annotated method rather than a synthetic lambda.
+     */
+    @edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
+            value = "IMPROPER_UNICODE",
+            justification =
+                    "Case folding of ASCII HTTP header names, not user identity"
+                            + " strings; Unicode case-folding does not apply.")
+    private static boolean isSensitiveHeader(Set<String> sensitiveHeaders, String name) {
+        return sensitiveHeaders.contains(name.toLowerCase(Locale.ROOT));
+    }
+
+    /**
+     * Whether a header name is an entity header ({@code Content-Type} /
+     * {@code Content-Length}) that must be dropped when a redirect changes
+     * the request to a bodyless GET. Extracted from the redirect
+     * {@code removeIf} lambda so the ASCII case comparison sits in a named,
+     * annotated method rather than a synthetic lambda.
+     */
+    @edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
+            value = "IMPROPER_UNICODE",
+            justification =
+                    "Case-insensitive comparison of ASCII HTTP header names, not user"
+                            + " identity strings; Unicode case-folding does not apply.")
+    private static boolean isEntityHeader(String name) {
+        return "content-type".equalsIgnoreCase(name)
+                || "content-length".equalsIgnoreCase(name);
+    }
+
     /**
      * Normalize a URI port, returning the default-port value (443 for
      * https, 80 for http) when the URI does not specify an explicit port.
@@ -592,6 +659,11 @@ private static boolean isRedirect(int statusCode) {
      * and sensitive headers are not stripped on a redirect that only adds
      * the implicit default port.
      */
+    @edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
+            value = "IMPROPER_UNICODE",
+            justification =
+                    "Case-insensitive comparison of ASCII URI scheme tokens, not user"
+                            + " identity strings; Unicode case-folding does not apply.")
     private static int effectivePort(URI uri) {
         int port = uri.getPort();
         if (port != -1) {
@@ -610,6 +682,11 @@ private static int effectivePort(URI uri) {
      * are normalised to scheme defaults so {@code https://host/x} and
      * {@code https://host:443/x} compare equal.
      */
+    @edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
+            value = "IMPROPER_UNICODE",
+            justification =
+                    "Case-insensitive comparison of ASCII URI scheme tokens, not user"
+                            + " identity strings; Unicode case-folding does not apply.")
     private static boolean sameOrigin(URI originalUri, URI redirectUri) {
         return redirectUri.getHost() != null
                 && redirectUri.getScheme() != null
@@ -628,6 +705,11 @@ private static boolean sameOrigin(URI originalUri, URI redirectUri) {
      * HTTP, the response is 307 or 308, and there is a non-empty body to
      * leak.
      */
+    @edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
+            value = "IMPROPER_UNICODE",
+            justification =
+                    "Case-insensitive comparison of ASCII URI scheme tokens, not user"
+                            + " identity strings; Unicode case-folding does not apply.")
     static boolean shouldRefuseHttpsToHttpBodyReplay(
             URI originalUri, URI redirectUri, int statusCode, boolean hasBody) {
         if (!hasBody) {
@@ -668,6 +750,11 @@ private static Charset parseCharset(String contentType) {
         }
     }
 
+    @edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
+            value = "IMPROPER_UNICODE",
+            justification =
+                    "Case folding of ASCII media-type tokens for content sniffing, not"
+                            + " user identity strings; Unicode case-folding does not apply.")
     private static boolean isTextContentType(String contentType) {
         int semi = contentType.indexOf(';');
         String mediaType = (semi >= 0 ? contentType.substring(0, semi) : contentType).trim().toLowerCase(Locale.ROOT);
@@ -695,6 +782,11 @@ private static boolean isTextContentType(String contentType) {
      * @param encoding the Content-Encoding header value
      * @return the decompressed body bytes
      */
+    @edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
+            value = "IMPROPER_UNICODE",
+            justification =
+                    "Case folding of ASCII Content-Encoding tokens, not user identity"
+                            + " strings; Unicode case-folding does not apply.")
     private static byte[] decompressBody(byte[] data, String encoding) throws IOException {
         if (data.length == 0) {
             return new byte[0];

src/main/java/com/zitadel/TransportOptions.java

@@ -238,6 +238,12 @@ public Builder caCertPath(@Nullable String caCertPath) {
          * @return this builder
          * @throws IllegalArgumentException if the proxy URL is not a valid URI
          */
+        @edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
+                value = "IMPROPER_UNICODE",
+                justification =
+                        "Case-insensitive comparison of ASCII URI scheme tokens"
+                                + " (http/https), not user identity strings; Unicode"
+                                + " case-folding does not apply.")
         public Builder proxy(@Nullable String proxy) {
             if (proxy != null) {
                 java.net.URI uri;

src/main/java/com/zitadel/Zitadel.java

@@ -12,7 +12,7 @@
 import java.util.function.Consumer;
 
 @SuppressWarnings({"unused", "DeprecatedIsStillUsed"})
-public class Zitadel {
+public final class Zitadel {
     /**
      * The underlying, configured API client.
      *

src/main/java/com/zitadel/api/BaseApi.java

@@ -118,6 +118,12 @@ public BaseApi(ApiClient apiClient, Configuration config, @Nullable Authenticato
      * @throws ApiException if the API call fails
      */
     @SuppressWarnings("unchecked")
+    @edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
+            value = "IMPROPER_UNICODE",
+            justification =
+                    "Case-insensitive comparison of ASCII HTTP header/media-type tokens,"
+                            + " not user identity strings; Unicode case-folding does not"
+                            + " apply.")
     protected <T> ApiResult<T> invokeApiForResult(
             String method,
             String path,
@@ -440,6 +446,11 @@ private static boolean isValidCookieValue(String value) {
      * @param contentType the response Content-Type header value (possibly empty)
      * @return true when the body was kept as decoded text by the transport
      */
+    @edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
+            value = "IMPROPER_UNICODE",
+            justification =
+                    "Case folding of ASCII media-type tokens for content sniffing, not"
+                            + " user identity strings; Unicode case-folding does not apply.")
     private static boolean isTextResponseContentType(String contentType) {
         if (contentType == null || contentType.isEmpty()) {
             return true;

src/main/java/com/zitadel/auth/BearerAuthenticator.java

@@ -52,6 +52,12 @@ public String getHost() {
     }
 
     @Override
+    @edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
+            value = "IMPROPER_UNICODE",
+            justification =
+                    "Case-insensitive comparison of the ASCII \"Bearer \" auth-scheme"
+                            + " prefix, not a user identity string; Unicode case-folding"
+                            + " does not apply.")
     public Map<String, String> getAuthHeaders() {
         /* Dedupe "Bearer " prefix (case-insensitive ASCII): tokens read
          * from env files are commonly stored already-prefixed; emitting

src/main/java/com/zitadel/utils/URLUtil.java

@@ -1,6 +1,8 @@
 package com.zitadel.utils;
 
+import java.net.MalformedURLException;
 import java.net.URI;
+import java.net.URISyntaxException;
 import java.net.URL;
 
 public class URLUtil {
@@ -17,7 +19,7 @@ public static URL buildHostname(String hostname) {
             }
 
             return new URI(hostname).toURL();
-        } catch (Exception e) {
+        } catch (URISyntaxException | MalformedURLException e) {
             throw new RuntimeException(e);
         }
     }