danhuawang opened a new issue, #11029:
URL: https://github.com/apache/gravitino/issues/11029
### Version
main branch
### Describe what's wrong
`WebUIFilter.doFilter()` throws a `NullPointerException` when
`httpRequest.getRequestURI()` returns `null`. The filter directly calls
`path.lastIndexOf("/")` without a null check, causing the request to fail with
a 500 error.
### Error message and/or stacktrace
```
2026-05-10 19:15:10.373 INFO [main]
[org.apache.gravitino.job.BuiltInJobTemplateEventListener.lambda$reconcileBuiltInJobTemplates$10(BuiltInJobTemplateEventListener.java:275)]
- Built-in job template builtin-iceberg-update-stats under metalake metalake_a
is up to date
2026-05-10 19:15:10.374 INFO [main]
[org.apache.gravitino.listener.EventListenerPluginWrapper.start(EventListenerPluginWrapper.java:56)]
- Start event listener builtin-job-template.
2026-05-10 19:15:10.378 INFO [main]
[org.eclipse.jetty.server.Server.doStart(Server.java:375)] -
jetty-9.4.58.v20250814; built: 2025-08-14T02:28:49.637Z; git:
8f1440587e9e4ae7db3d74cf205643f3d707148d; jvm 17.0.16+8
2026-05-10 19:15:14.785 INFO [main]
[org.eclipse.jetty.server.handler.ContextHandler.doStart(ContextHandler.java:921)]
- Started o.e.j.s.ServletContextHandler@77cc6a28{/,null,AVAILABLE}
2026-05-10 19:15:14.886 INFO [main]
[org.eclipse.jetty.server.AbstractConnector.doStart(AbstractConnector.java:333)]
- Started ServerConnector@55c46ec1{HTTP/1.1, (http/1.1)}{0.0.0.0:9001}
2026-05-10 19:15:14.887 INFO [main]
[org.eclipse.jetty.server.Server.doStart(Server.java:415)] - Started @27200ms
2026-05-10 19:15:14.888 WARN [main]
[org.apache.gravitino.server.web.JettyServer.start(JettyServer.java:206)] -
Users would better use HTTPS to avoid token data leak.
2026-05-10 19:15:14.888 INFO [main]
[org.apache.gravitino.server.web.JettyServer.start(JettyServer.java:209)] -
iceberg-rest web server started on host 0.0.0.0 port 9001.
2026-05-10 19:15:14.888 INFO [main]
[org.apache.gravitino.iceberg.RESTService.serviceStart(RESTService.java:191)] -
Iceberg REST service started
2026-05-10 19:15:14.889 INFO [main]
[org.eclipse.jetty.server.Server.doStart(Server.java:375)] -
jetty-9.4.58.v20250814; built: 2025-08-14T02:28:49.637Z; git:
8f1440587e9e4ae7db3d74cf205643f3d707148d; jvm 17.0.16+8
2026-05-10 19:15:15.579 INFO [main]
[org.eclipse.jetty.webapp.StandardDescriptorProcessor.visitServlet(StandardDescriptorProcessor.java:277)]
- NO JSP Support for /, did not find org.eclipse.jetty.jsp.JettyJspServlet
2026-05-10 19:15:15.591 INFO [main]
[org.eclipse.jetty.server.session.DefaultSessionIdManager.doStart(DefaultSessionIdManager.java:334)]
- DefaultSessionIdManager workerName=node0
2026-05-10 19:15:15.592 INFO [main]
[org.eclipse.jetty.server.session.DefaultSessionIdManager.doStart(DefaultSessionIdManager.java:339)]
- No SessionScavenger set, using defaults
2026-05-10 19:15:15.594 INFO [main]
[org.eclipse.jetty.server.session.HouseKeeper.startScavenging(HouseKeeper.java:132)]
- node0 Scavenging every 600000ms
2026-05-10 19:15:18.672 INFO [main]
[org.eclipse.jetty.server.handler.ContextHandler.doStart(ContextHandler.java:921)]
- Started
o.e.j.w.WebAppContext@50734cea{gravitino-web,/,jar:file:///opt/gravitino/web-v2/gravitino-web-1.3.0-SNAPSHOT-1.0.0-SNAPSHOT.war!/,AVAILABLE}{/opt/gravitino/web-v2/gravitino-web-1.3.0-SNAPSHOT-1.0.0-SNAPSHOT.war}
2026-05-10 19:15:18.674 INFO [main]
[org.eclipse.jetty.server.AbstractConnector.doStart(AbstractConnector.java:333)]
- Started ServerConnector@4e6280de{HTTP/1.1, (http/1.1)}{0.0.0.0:8090}
2026-05-10 19:15:18.674 INFO [main]
[org.eclipse.jetty.server.Server.doStart(Server.java:415)] - Started @30988ms
2026-05-10 19:15:18.675 WARN [main]
[org.apache.gravitino.server.web.JettyServer.start(JettyServer.java:206)] -
Users would better use HTTPS to avoid token data leak.
2026-05-10 19:15:18.675 INFO [main]
[org.apache.gravitino.server.web.JettyServer.start(JettyServer.java:209)] -
Gravitino-webserver web server started on host 0.0.0.0 port 8090.
2026-05-10 19:15:18.676 INFO [main]
[org.apache.gravitino.server.DatastratoGravitinoServer.main(DatastratoGravitinoServer.java:37)]
- Done, Datastrato Gravitino server started.
2026-05-10 19:20:01.085 INFO [RelationalBackend-Garbage-Collector]
[org.apache.gravitino.storage.relational.RelationalGarbageCollector.collectAndClean(RelationalGarbageCollector.java:94)]
- Start to collect and delete old version data by thread 23
2026-05-10 19:30:30.474 WARN [Gravitino-webserver-44]
[org.eclipse.jetty.server.HttpChannel.handleException(HttpChannel.java:776)] -
null
java.lang.NullPointerException: Cannot invoke "String.lastIndexOf(String)"
because "path" is null
at
org.apache.gravitino.server.web.ui.WebUIFilter.doFilter(WebUIFilter.java:39)
~[gravitino-server-1.3.0-SNAPSHOT-1.0.0-SNAPSHOT.jar:?]
at
org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
~[jetty-servlet-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1626)
~[jetty-servlet-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:552)
~[jetty-servlet-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
~[jetty-server-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:600)
~[jetty-security-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
~[jetty-server-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235)
~[jetty-server-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1624)
~[jetty-server-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233)
~[jetty-server-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1440)
~[jetty-server-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188)
~[jetty-server-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:505)
~[jetty-servlet-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1594)
~[jetty-server-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186)
~[jetty-server-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1355)
~[jetty-server-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
~[jetty-server-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:146)
~[jetty-server-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
~[jetty-server-9.4.58.v20250814.jar:9.4.58.v20250814]
at org.eclipse.jetty.server.Server.handle(Server.java:516)
~[jetty-server-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:487)
~[jetty-server-9.4.58.v20250814.jar:9.4.58.v20250814]
at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:732)
~[jetty-server-9.4.58.v20250814.jar:9.4.58.v20250814]
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:479)
~[jetty-server-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:277)
~[jetty-server-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311)
~[jetty-io-9.4.58.v20250814.jar:9.4.58.v20250814]
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)
~[jetty-io-9.4.58.v20250814.jar:9.4.58.v20250814]
at org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104)
~[jetty-io-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:338)
~[jetty-util-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:315)
~[jetty-util-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:173)
~[jetty-util-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.produce(EatWhatYouKill.java:137)
~[jetty-util-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:883)
[jetty-util-9.4.58.v20250814.jar:9.4.58.v20250814]
at
org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1034)
[jetty-util-9.4.58.v20250814.jar:9.4.58.v20250814]
at java.base/java.lang.Thread.run(Thread.java:840) [?:?]
```
### How to reproduce
- Gravitino version: main branch
- Send an HTTP request to the Gravitino web server (port 8090) where
`HttpServletRequest.getRequestURI()` returns `null` (e.g., via a malformed
request or certain reverse proxy configurations that strip the request URI).
- Observe the WARN log with NPE from `WebUIFilter.doFilter`.
**Root cause:**
In
`server/src/main/java/org/apache/gravitino/server/web/ui/WebUIFilter.java` line
39-40:
```java
String path = httpRequest.getRequestURI();
String lastPathSegment = path.substring(path.lastIndexOf("/") + 1); // NPE
when path is null
There is no null guard on path before it is used.
Suggested fix: Add a null check before using path:
String path = httpRequest.getRequestURI();
if (path == null) {
chain.doFilter(request, response);
return;
}
### Additional context
The exception is caught by Jetty and logged as WARN, so the server does not
crash. However, affected requests will receive a 500 error response. The issue
was observed approximately 15 minutes after server startup, suggesting it is
triggered by a specific client request pattern rather than occurring at startup.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
