apache / apache/maven-dependency-plugin
Potential NPE in PropertiesMojo when artifact.getFile() returns null
- Dominant language
- Java
- Stars
- 175
- Forks
- 196
- Avg merge
- 19h 30m
- Merged PRs (30d)
- 5
Description
`PropertiesMojo.execute()` at line 114-118:
```java
for (Artifact artifact : artifacts) {
project.getProperties()
.setProperty(
artifact.getDependencyConflictId(),
artifact.getFile().getAbsolutePath()); // NPE if null
}
```
`project.getArtifacts()` can include artifacts where `getFile()` returns `null` (e.g., unresolved optional dependencies, artifacts with resolution failures that don't fully fail the build). Calling `.getAbsolutePath()` on null throws NPE and fails the build.
The extra artifact resolution at lines 129-136 has a similar issue:
```java
artifact = resolverUtil.resolveArtifact(artifact, project.getRemoteProjectRepositories());
this.project.getProperties().setProperty(toConflictId(artifact), artifact.getFile().getAbsolutePath());
```
If resolution succeeds but returns a null file, this also NPEs.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in PropertiesMojo.execute() at the two artifact property-setting paths shown in the issue, including the extra resolution branch. Trace how unresolved or optionally unresolved artifacts can have a null file, then verify that such artifacts no longer trigger an NPE while artifacts with files still produce their absolute paths.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 74/100