apache / apache/maven-dependency-tree

Potential NPE in getVersionSelectedFromRange when the range is null

Open Beginner friendly
#137 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
27
Forks
31
Avg merge
5h 53m
Merged PRs (30d)
1

Description

## Summary
`getVersionSelectedFromRange(...)` dereferences `constraint.getRange().toString()` whenever the constraint has no direct version, without guarding against a null range. A `VersionConstraint` where both `getVersion()` and `getRange()` are null would throw a `NullPointerException`.

## Affected code
- `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyCollectorBuilder.java:238-244`
- `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyGraphBuilder.java:166-172`

## Impact
In practice Aether usually guarantees at least one of version/range is set, so this is an edge case — but it is unguarded and cheap to make robust.

## Suggested fix
```
if ((constraint == null) || (constraint.getVersion() != null) || (constraint.getRange() == null)) {
return null;
}
return constraint.getRange().toString();
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Read getVersionSelectedFromRange(...) in DefaultDependencyCollectorBuilder.java:238-244 and DefaultDependencyGraphBuilder.java:166-172, comparing how each handles a VersionConstraint without a direct version. Confirm the null-range case is safe in both entry points and that existing behavior for normal version or range constraints is unchanged.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.