apache / apache/maven-jarsigner-plugin

NPE in decrypt() when securityDispatcher is null

Open
#146 0 comments 0 reactions 0 assignees View on GitHub
bug priority:critical
Dominant language
Java
Stars
23
Forks
18
Avg merge
4h 23m
Merged PRs (30d)
2

Description

**Affected version:** HEAD

**Files:**
- `src/main/java/org/apache/maven/plugins/jarsigner/AbstractJarsignerMojo.java:562`
- `src/main/java/org/apache/maven/plugins/jarsigner/JarsignerSignMojo.java:313`
- `src/main/java/org/apache/maven/plugins/jarsigner/JarsignerVerifyMojo.java:75-77`

The `decrypt()` method and its callers dereference `securityDispatcher` without a null check:

```java
// AbstractJarsignerMojo.java:560-567
protected String decrypt(String encoded) throws MojoExecutionException {
try {
return securityDispatcher.decrypt(encoded); // NPE if securityDispatcher is null
} catch (SecDispatcherException e) {
...
}
}
```

```java
// processArchive() line 540
request.setStorepass(decrypt(storepass));

// JarsignerSignMojo.createRequest() line 313
request.setKeypass(decrypt(keypass));
```

The no-arg test constructors (`JarsignerSignMojo.java:242`, `JarsignerVerifyMojo.java:75`) pass `null` for `securityDispatcher` to the super constructor, and instantiation via reflection (`MojoTestCreator.java:92`) relies on subsequent field injection to set it. If instantiation is done without setting `securityDispatcher`, any call to `execute()` will NPE.

The fix should either guard `decrypt()` with a null check, or require `securityDispatcher` to be non-null in the constructors.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with decrypt() in src/main/java/org/apache/maven/plugins/jarsigner/AbstractJarsignerMojo.java and trace its callers in JarsignerSignMojo.java and JarsignerVerifyMojo.java. Review the no-argument constructors and MojoTestCreator.java to decide how null securityDispatcher is handled; done means execute() no longer fails with an unexpected NullPointerException when it is unset.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.