elharo opened a new issue, #12601:
URL: https://github.com/apache/maven/issues/12601
# DefaultModelBuilder: NPE from null source location in parentChain set
**Found in:** maven-4.0.x branch
**File:**
`impl/maven-impl/src/main/java/org/apache/maven/impl/model/DefaultModelBuilder.java`
(lines 1164-1166)
**Severity:** Medium
## Description
`ModelSource.getLocation()` has a `@Nullable` contract, but its return value
is passed directly to `parentChain.add()`:
```java
String sourceLocation = candidateSource.getLocation();
if (!parentChain.add(sourceLocation)) { // NPE if null
```
`parentChain` is a `LinkedHashSet`, and most `Set` implementations
(including `LinkedHashSet`) do not allow null elements. If
`candidateSource.getLocation()` returns null, `Set.add(null)` throws a
`NullPointerException`. This can be triggered when resolving parent POMs from
non-file sources.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
