New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
JarUrlConnection.getPermission() can throw NullPointerException if jarFileConnection is null #39856
Conversation
if given resource path is not found and JavaSecurityManager is enabled, NullPointerException is thrown internaly. Not only it is simply meaningless exception, but also it might be cause of performance regression. StackTrace is like bellow: java.lang.NullPointerException: Cannot invoke "java.net.URLConnection.getPermission()" because "this.jarFileConnection" is null at org.springframework.boot.loader.net.protocol.jar.JarUrlConnection.getPermission(JarUrlConnection.java:175) at java.base/jdk.internal.loader.URLClassPath.check(URLClassPath.java:553) at java.base/jdk.internal.loader.URLClassPath$Loader.findResource(URLClassPath.java:612) at java.base/jdk.internal.loader.URLClassPath.findResource(URLClassPath.java:296) at java.base/java.net.URLClassLoader$2.run(URLClassLoader.java:629) at java.base/java.net.URLClassLoader$2.run(URLClassLoader.java:627) at java.base/java.security.AccessController.doPrivileged(AccessController.java:399) at java.base/java.net.URLClassLoader.findResource(URLClassLoader.java:626) at org.springframework.boot.loader.net.protocol.jar.JarUrlClassLoader.findResource(JarUrlClassLoader.java:70) at java.base/java.lang.ClassLoader.getResource(ClassLoader.java:1403) at java.base/java.net.URLClassLoader.getResourceAsStream(URLClassLoader.java:290) at java.base/java.lang.Class.getResourceAsStream(Class.java:2850)
Thanks for the proposal but, following its deprecation in the JDK, we don't support running with the security manager enabled. Support was removed in #28213. |
Looking again at this one I think we probably should merge it. Although we don't support running with the security manager the The only thing I'm not sure about is if we can return null. The class loader implementation used to throw an exception. We could do that or return |
Throwing an exception looks like the best option. |
@philwebb Thank you for seeing my suggestion. Sorry for the delay in noticing. according to javadoc in
please comment me if I can be of any help to you. |
Fix regression in `JarUrlConnection` where a NullPointerException could be thrown internally causing performance issues. When the SecurityManager is present, the following stack trace is thrown: java.lang.NullPointerException: Cannot invoke "java.net.URLConnection.getPermission()" because "this.jarFileConnection" is null at org.springframework.boot.loader.net.protocol.jar.JarUrlConnection.getPermission(JarUrlConnection.java:175) at java.base/jdk.internal.loader.URLClassPath.check(URLClassPath.java:553) at java.base/jdk.internal.loader.URLClassPath$Loader.findResource(URLClassPath.java:612) at java.base/jdk.internal.loader.URLClassPath.findResource(URLClassPath.java:296) at java.base/java.net.URLClassLoader$2.run(URLClassLoader.java:629) at java.base/java.net.URLClassLoader$2.run(URLClassLoader.java:627) at java.base/java.security.AccessController.doPrivileged(AccessController.java:399) at java.base/java.net.URLClassLoader.findResource(URLClassLoader.java:626) at org.springframework.boot.loader.net.protocol.jar.JarUrlClassLoader.findResource(JarUrlClassLoader.java:70) at java.base/java.lang.ClassLoader.getResource(ClassLoader.java:1403) at java.base/java.net.URLClassLoader.getResourceAsStream(URLClassLoader.java:290) at java.base/java.lang.Class.getResourceAsStream(Class.java:2850) See gh-39856
Thanks again @yokotaso. This has now been merged. |
Thank you for developing great springframework and spring-boot ecosystem, I appreciate development.
if given resource path is not found and JavaSecurityManager is enabled, NullPointerException is thrown internally.
Not only it is simply meaningless exception,
but also it might be cause of performance regression.
StackTrace is like bellow.
I got above stacktrace with using debugger around
catch
statement injdk.internal.loader.URLClassPath.Loader#findResource
and invokingException#printStackTrace()