Close out the remaining small note-tier CodeQL categories

OpenICF-java-framework/connector-framework-contract/src/main/java/org/identityconnectors/contract/test/ContractITCase.java

@@ -20,6 +20,8 @@
  * with the fields enclosed by brackets [] replaced by
  * your own identifying information:
  * "Portions Copyrighted [year] [name of copyright owner]"
+ *
+ * Portions Copyrighted 2026 3A Systems LLC.
  */
 
 package org.identityconnectors.contract.test;
@@ -32,12 +34,9 @@
 
 import org.identityconnectors.common.StringUtil;
 import org.identityconnectors.contract.data.DataProvider;
-import org.identityconnectors.framework.api.ConnectorFacade;
-import org.identityconnectors.framework.common.objects.Schema;
 import org.testng.IObjectFactory;
 import org.testng.ITestContext;
 import org.testng.annotations.Factory;
-import org.testng.internal.ObjectFactoryImpl;
 
 import com.google.inject.Guice;
 import com.google.inject.Injector;
@@ -111,14 +110,4 @@ public Injector getInjector(ITestContext context) {
     public DataProvider getDataProvider(ITestContext context) {
         return ConnectorHelper.createDataProvider();
     }
-
-    private static class ContractTestFactory {
-
-        private ConnectorFacade connectorFacade = null;
-
-        private Schema schema = null;
-
-        private IObjectFactory objectFactory = new ObjectFactoryImpl();
-
-    }
 }

OpenICF-java-framework/connector-framework/src/main/java/org/identityconnectors/common/security/GuardedString.java

@@ -291,4 +291,13 @@ public boolean equals(Object o) {
     public int hashCode() {
         return base64SHA1Hash.hashCode();
     }
+
+    /**
+     * Never prints the clear text; the default {@link Object#toString()} would not either,
+     * but its output is just a class name and hash code, not useful for logging.
+     */
+    @Override
+    public String toString() {
+        return "GuardedString(...)";
+    }
 }

OpenICF-java-framework/connector-framework/src/test/java/org/identityconnectors/common/security/GuardedStringTests.java

@@ -19,6 +19,8 @@
  * enclosed by brackets [] replaced by your own identifying information:
  * "Portions Copyrighted [year] [name of copyright owner]"
  * ====================
+ *
+ * Portions Copyrighted 2026 3A Systems LLC.
  */
 package org.identityconnectors.common.security;
 
@@ -121,6 +123,13 @@ public void testDispose() {
         }
     }
 
+    @Test
+    public void testToStringNeverExposesTheClearText() {
+        GuardedString str = new GuardedString("secret".toCharArray());
+        assertFalse(str.toString().contains("secret"),
+                "toString() must never leak the clear text");
+    }
+
     @Test
     public void testUnicode() {
 

OpenICF-ldap-connector/src/main/java/org/identityconnectors/ldap/search/LdapInternalSearch.java

@@ -20,6 +20,7 @@
  * "Portions Copyrighted [year] [name of copyright owner]"
  * ====================
  * "Portions Copyrighted 2014 ForgeRock AS"
+ * Portions Copyrighted 2026 3A Systems LLC.
  */
 package org.identityconnectors.ldap.search;
 
@@ -59,9 +60,9 @@ public LdapInternalSearch(LdapConnection conn, String filter, List<String> baseD
     }
 
     public void execute(LdapSearchResultsHandler handler) {
-        String filter = blankAsAllObjects(this.filter);
+        String effectiveFilter = blankAsAllObjects(this.filter);
         try {
-            strategy.doSearch(conn.getInitialContext(), baseDNs, filter, controls, handler);
+            strategy.doSearch(conn.getInitialContext(), baseDNs, effectiveFilter, controls, handler);
         } catch (IOException e) {
             throw new ConnectorException(e);
         } catch (PartialResultException e) {