elharo opened a new issue, #146:
URL: https://github.com/apache/maven-jarsigner-plugin/issues/146
**Affected version:** HEAD
**Files:**
-
`src/main/java/org/apache/maven/plugins/jarsigner/AbstractJarsignerMojo.java:562`
-
`src/main/java/org/apache/maven/plugins/jarsigner/JarsignerSignMojo.java:313`
-
`src/main/java/org/apache/maven/plugins/jarsigner/JarsignerVerifyMojo.java:75-77`
The `decrypt()` method and its callers dereference `securityDispatcher`
without a null check:
```java
// AbstractJarsignerMojo.java:560-567
protected String decrypt(String encoded) throws MojoExecutionException {
try {
return securityDispatcher.decrypt(encoded); // NPE if
securityDispatcher is null
} catch (SecDispatcherException e) {
...
}
}
```
```java
// processArchive() line 540
request.setStorepass(decrypt(storepass));
// JarsignerSignMojo.createRequest() line 313
request.setKeypass(decrypt(keypass));
```
The no-arg test constructors (`JarsignerSignMojo.java:242`,
`JarsignerVerifyMojo.java:75`) pass `null` for `securityDispatcher` to the
super constructor, and instantiation via reflection (`MojoTestCreator.java:92`)
relies on subsequent field injection to set it. If instantiation is done
without setting `securityDispatcher`, any call to `execute()` will NPE.
The fix should either guard `decrypt()` with a null check, or require
`securityDispatcher` to be non-null in the constructors.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
