This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 33a3acd94a1335ba1acfec0ae460d6473a5255b2 Author: opencode <[email protected]> AuthorDate: Wed Oct 14 09:38:16 2026 +0200 Avoid NPE in SimpleInstanceManager.newInstance(String) with null TCCL SimpleInstanceManager.newInstance(String) dereferenced the thread context class loader without a null check. Thread.getContextClassLoader() is documented to return null in some cases and NullPointerException is not part of the InstanceManager.newInstance(String) contract, so a raw NPE could escape to callers. Fall back to the class loader of SimpleInstanceManager when the thread context class loader is null, matching the established pattern used by JspRuntimeContext and Registry. This turns the previous undeclared NPE into the contract-declared ClassNotFoundException when the class cannot be resolved, and has no effect on the normal case where the thread context class loader is set. --- java/org/apache/tomcat/SimpleInstanceManager.java | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/java/org/apache/tomcat/SimpleInstanceManager.java b/java/org/apache/tomcat/SimpleInstanceManager.java index 8988289d2c..417e942270 100644 --- a/java/org/apache/tomcat/SimpleInstanceManager.java +++ b/java/org/apache/tomcat/SimpleInstanceManager.java @@ -43,7 +43,11 @@ public class SimpleInstanceManager implements InstanceManager { @Override public Object newInstance(String className) throws IllegalAccessException, InvocationTargetException, NamingException, InstantiationException, ClassNotFoundException, NoSuchMethodException { - Class<?> clazz = Thread.currentThread().getContextClassLoader().loadClass(className); + ClassLoader classLoader = Thread.currentThread().getContextClassLoader(); + if (classLoader == null) { + classLoader = SimpleInstanceManager.class.getClassLoader(); + } + Class<?> clazz = classLoader.loadClass(className); return clazz.getConstructor().newInstance(); } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
