apache / apache/maven-dependency-tree
Potential NPE in getVersionSelectedFromRange when the range is null
- Dominant language
- Java
- Stars
- 27
- Forks
- 31
- Avg merge
- 5h 53m
- Merged PRs (30d)
- 1
Description
## Summary
`getVersionSelectedFromRange(...)` dereferences `constraint.getRange().toString()` whenever the constraint has no direct version, without guarding against a null range. A `VersionConstraint` where both `getVersion()` and `getRange()` are null would throw a `NullPointerException`.
## Affected code
- `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyCollectorBuilder.java:238-244`
- `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyGraphBuilder.java:166-172`
## Impact
In practice Aether usually guarantees at least one of version/range is set, so this is an edge case — but it is unguarded and cheap to make robust.
## Suggested fix
```
if ((constraint == null) || (constraint.getVersion() != null) || (constraint.getRange() == null)) {
return null;
}
return constraint.getRange().toString();
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Read getVersionSelectedFromRange(...) in DefaultDependencyCollectorBuilder.java:238-244 and DefaultDependencyGraphBuilder.java:166-172, comparing how each handles a VersionConstraint without a direct version. Confirm the null-range case is safe in both entry points and that existing behavior for normal version or range constraints is unchanged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100