https://bz.apache.org/bugzilla/show_bug.cgi?id=70163
Bug ID: 70163
Summary: Missing null check for findManagedBean result in
StoreConfigLifecycleListener
Product: Tomcat 9
Version: 9.0.x
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Catalina
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: -----
Created attachment 40204
--> https://bz.apache.org/bugzilla/attachment.cgi?id=40204&action=edit
Fix potential NPE in StoreConfigLifecycleListener
The Registry.findManagedBean() method is supposed to return null if it can't
find a requested managed bean. This is how it's usually used and how similar
methods work.
In StoreConfigLifecycleListener.getManagedBean(), when
findManagedBean("StoreConfig") doesn't find the bean, it currently throws an
IllegalStateException. This stops a NullPointerException later, but it makes
the whole application crash if the StoreConfig bean is missing when the app
starts up.
The change suggested here is different. Instead of throwing an exception, the
method will now check if the bean is null and just return null.
Here's why this change makes sense:
1. It follows the standard behavior of findManagedBean. That method signals a
missing resource by returning null, and it's up to the one calling it to deal
with that.
2. This lets the code calling getManagedBean() handle a missing configuration
more smoothly. For example, it could log a warning, use a default setting, or
just skip registering the MBean, instead of stopping the entire startup.
3. This also fixes a warning (Svace DEREF_OF_NULL.RET.STAT) about potentially
using a null value without checking it first.
Even though this changes how the method behaves - from throwing an exception to
returning null - it's generally better for a component like a lifecycle
listener to handle missing things gracefully by returning null. This is
especially true in unusual situations, like special test setups or when JMX
features are limited, where the StoreConfig might genuinely not be there.
This issue was found by the Linux Verification Center (linuxtesting.org) using
Svace.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
