[MNG-7375] Potential NPE in o.a.m.artifact.repository.metadata.Metadata.merge(...) with invalid/incomplete plugin metadata

**[Konrad Windszus](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=kwin)** opened **[MNG-7375](https://issues.apache.org/jira/browse/MNG-7375?redirect=false)** and commented

Currently the metadata at https://repository.apache.org/service/local/repositories/snapshots/content/org/apache/jackrabbit/maven-metadata.xml contains an invalid entry without a prefix:

```xml

Apache Jackrabbit FileVault - Package Maven Plugin
filevault-package
filevault-package-maven-plugin


filevault-package-maven-plugin
filevault-package-maven-plugin

```

This leads to an NPE when trying to deploy a new version with `org.apache.maven.artifact.deployer.DefaultArtifactDeployer.deploy(...)`:

```
Caused by: java.lang.NullPointerException
at org.apache.maven.artifact.repository.metadata.Metadata.merge (Metadata.java:276)
at org.apache.maven.artifact.repository.metadata.AbstractRepositoryMetadata.updateRepositoryMetadata (AbstractRepositoryMetadata.java:121)
at org.apache.maven.artifact.repository.metadata.AbstractRepositoryMetadata.storeInLocalRepository (AbstractRepositoryMetadata.java:67)
at org.apache.maven.artifact.repository.metadata.MetadataBridge.merge (MetadataBridge.java:65)
at org.eclipse.aether.internal.impl.DefaultDeployer.upload (DefaultDeployer.java:433)
at org.eclipse.aether.internal.impl.DefaultDeployer.deploy (DefaultDeployer.java:321)
at org.eclipse.aether.internal.impl.DefaultDeployer.deploy (DefaultDeployer.java:213)
at org.eclipse.aether.internal.impl.DefaultRepositorySystem.deploy (DefaultRepositorySystem.java:386)
at org.apache.maven.artifact.deployer.DefaultArtifactDeployer.deploy (DefaultArtifactDeployer.java:142)
```

Although this happened in the context of using "[org.sonatype.plugins:nexus-staging-maven-plugin](https://github.com/sonatype/nexus-maven-plugins):1.6.8" (issue https://issues.sonatype.org/browse/NEXUS-30749 opened, exported to [^NEXUS-30749 - Broken groupId metadata and follow-up NPE during org.sonatype.nexus.maven.staging.deploy.strategy.AbstractDeployStrategy.deployUp - Sonatype JIRA.pdf] ), the affected code is in Maven.

The metadata is probably invalid but the Metadata class should be more robust when trying to do the merge in https://github.com/apache/maven/blob/951b5ee95f40147abbc2bb9d928e408b85d5aef3/maven-repository-metadata/src/main/mdo/metadata.mdo#L100 and just ignore all plugin entries without all mandatory elements.

---

**Affects:** 3.8.4

**Attachments:**
- [NEXUS-30749 - Broken groupId metadata and follow-up NPE during org.sonatype.nexus.maven.staging.deploy.strategy.AbstractDeployStrategy.deployUp - Sonatype JIRA.pdf](https://issues.apache.org/jira/secure/attachment/13038164/NEXUS-30749+-+Broken+groupId+metadata+and+follow-up+NPE+during+org.sonatype.nexus.maven.staging.deploy.strategy.AbstractDeployStrategy.deployUp+-+Sonatype+JIRA.pdf) (_176.00 kB_)

**Issue Links:**
- [MNG-7055](https://issues.apache.org/jira/browse/MNG-7055) Using MINSTALL/DEPLOY 3.0.0-M1+ does not write plugin information into maven-metadata.xml

- [INFRA-22667](https://issues.apache.org/jira/browse/INFRA-22667) Fix invalid metadata in https://repository.apache.org/service/local/repositories/snapshots/content/org/apache/jackrabbit/maven-metadata.xml

- [JCRVLT-579](https://issues.apache.org/jira/browse/JCRVLT-579) CI/CD: Snapshot deployment fails with NPE

- [MNG-7418](https://issues.apache.org/jira/browse/MNG-7418) Incorrect merging of snapshot versions in o.a.m.artifact.repository.metadata.Metadata.merge(...)

- [MNG-8121](https://issues.apache.org/jira/browse/MNG-8121) NullPointerException at org.apache.maven.artifact.repository.metadata.Metadata.merge (Metadata.java:293)

- [MPLUGIN-384](https://issues.apache.org/jira/browse/MPLUGIN-384) Nexus Staging Plugin - incompatibility

- [MNG-7385](https://issues.apache.org/jira/browse/MNG-7385) Improve documentation on repository metadata

- [MPLUGIN-377](https://issues.apache.org/jira/browse/MPLUGIN-377) Drop use of legacy APIs
(_**"is broken by"**_)

**Remote Links:**
- [GitHub Pull Request #645
](https://github.com/apache/maven/pull/645)
- [NEXUS-30749
](https://issues.sonatype.org/browse/NEXUS-30749)
- [NEXUS-30749
](https://issues.sonatype.org/browse/NEXUS-30749)

1 votes, 7 watchers