apache / apache/maven-jarsigner-plugin
NPE in decrypt() when securityDispatcher is null
- Dominant language
- Java
- Stars
- 23
- Forks
- 18
- Avg merge
- 4h 23m
- Merged PRs (30d)
- 2
Description
**Affected version:** HEAD
**Files:**
- `src/main/java/org/apache/maven/plugins/jarsigner/AbstractJarsignerMojo.java:562`
- `src/main/java/org/apache/maven/plugins/jarsigner/JarsignerSignMojo.java:313`
- `src/main/java/org/apache/maven/plugins/jarsigner/JarsignerVerifyMojo.java:75-77`
The `decrypt()` method and its callers dereference `securityDispatcher` without a null check:
```java
// AbstractJarsignerMojo.java:560-567
protected String decrypt(String encoded) throws MojoExecutionException {
try {
return securityDispatcher.decrypt(encoded); // NPE if securityDispatcher is null
} catch (SecDispatcherException e) {
...
}
}
```
```java
// processArchive() line 540
request.setStorepass(decrypt(storepass));
// JarsignerSignMojo.createRequest() line 313
request.setKeypass(decrypt(keypass));
```
The no-arg test constructors (`JarsignerSignMojo.java:242`, `JarsignerVerifyMojo.java:75`) pass `null` for `securityDispatcher` to the super constructor, and instantiation via reflection (`MojoTestCreator.java:92`) relies on subsequent field injection to set it. If instantiation is done without setting `securityDispatcher`, any call to `execute()` will NPE.
The fix should either guard `decrypt()` with a null check, or require `securityDispatcher` to be non-null in the constructors.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with decrypt() in src/main/java/org/apache/maven/plugins/jarsigner/AbstractJarsignerMojo.java and trace its callers in JarsignerSignMojo.java and JarsignerVerifyMojo.java. Review the no-argument constructors and MojoTestCreator.java to decide how null securityDispatcher is handled; done means execute() no longer fails with an unexpected NullPointerException when it is unset.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100