apache / apache/maven-dependency-plugin

Potential NPE in PropertiesMojo when artifact.getFile() returns null

Open Beginner friendly
#1,647 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
175
Forks
196
Avg merge
19h 30m
Merged PRs (30d)
5

Description

`PropertiesMojo.execute()` at line 114-118:

```java
for (Artifact artifact : artifacts) {
project.getProperties()
.setProperty(
artifact.getDependencyConflictId(),
artifact.getFile().getAbsolutePath()); // NPE if null
}
```

`project.getArtifacts()` can include artifacts where `getFile()` returns `null` (e.g., unresolved optional dependencies, artifacts with resolution failures that don't fully fail the build). Calling `.getAbsolutePath()` on null throws NPE and fails the build.

The extra artifact resolution at lines 129-136 has a similar issue:

```java
artifact = resolverUtil.resolveArtifact(artifact, project.getRemoteProjectRepositories());
this.project.getProperties().setProperty(toConflictId(artifact), artifact.getFile().getAbsolutePath());
```

If resolution succeeds but returns a null file, this also NPEs.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in PropertiesMojo.execute() at the two artifact property-setting paths shown in the issue, including the extra resolution branch. Trace how unresolved or optionally unresolved artifacts can have a null file, then verify that such artifacts no longer trigger an NPE while artifacts with files still produce their absolute paths.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
74/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.