(grails-core) 01/01: Fix bootWar NPE from stray CLI WebApplicationInitializer (#15377)

[ja...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

jamesfredley pushed a commit to branch feat/8.0.x-dbmigration-bootwar-npe-15377
in repository https://gitbox.apache.org/repos/asf/grails-core.git

commit 91ef59899f6b135b474221be76bf569ad52709bf
Author: James Fredley <ja...@users.noreply.github.com>
AuthorDate: Thu Jul 2 21:19:37 2026 -0400

    Fix bootWar NPE from stray CLI WebApplicationInitializer (#15377)
    
    The Database Migration plugins for Hibernate 5 and Hibernate 7 depend on
    grails-shell-cli at implementation scope, which places
    org.grails.cli.boot.SpringApplicationWebApplicationInitializer on the
    classpath of a normal application WAR. That class is a
    SpringBootServletInitializer intended only for CLI-packaged WARs built by
    the shell 'war' command, which records the application source classes in the
    WAR manifest via the 'Spring-Application-Source-Classes' entry.
    
    When a standard bootWar is deployed to an external servlet container such as
    Tomcat, Spring discovers the stray initializer and invokes onStartup. The
    manifest has no source-classes entry, so sources was null and split(",")
    threw a NullPointerException, crashing context startup.
    
    Make the initializer inert when the manifest entry is absent: it now returns
    before super.onStartup instead of throwing, so a normal WAR is unaffected
    while the application's own SpringBootServletInitializer bootstraps it. The
    CLI-packaged WAR path is unchanged because that manifest entry is present.
    This resolves the issue for both dbmigration plugins with no changes required
    in consuming applications.
    
    Fixes #15377
    
    Assisted-by: claude-code:claude-4.8-opus
---
 grails-shell-cli/build.gradle                      |  5 ++
 ...SpringApplicationWebApplicationInitializer.java | 15 +++++-
 ...ApplicationWebApplicationInitializerSpec.groovy | 54 ++++++++++++++++++++++
 3 files changed, 73 insertions(+), 1 deletion(-)

diff --git a/grails-shell-cli/build.gradle b/grails-shell-cli/build.gradle
index f3d4d7d068..1498cebab6 100644
--- a/grails-shell-cli/build.gradle
+++ b/grails-shell-cli/build.gradle
@@ -110,6 +110,11 @@ dependencies {
     testImplementation 'org.slf4j:slf4j-simple'
     testImplementation 'org.spockframework:spock-core'
 
+    // Required to load SpringApplicationWebApplicationInitializer (extends SpringBootServletInitializer)
+    // in tests; these are compileOnly for the main source set.
+    testImplementation 'org.springframework.boot:spring-boot'
+    testImplementation 'org.springframework:spring-web'
+
     testRuntimeOnly 'net.bytebuddy:byte-buddy' // Required by Spock's mocking support
 
     // any project that should be included in the end distribution should be included here
diff --git a/grails-shell-cli/src/main/groovy/org/grails/cli/boot/SpringApplicationWebApplicationInitializer.java b/grails-shell-cli/src/main/groovy/org/grails/cli/boot/SpringApplicationWebApplicationInitializer.java
index c993cdd695..f73a9216d2 100644
--- a/grails-shell-cli/src/main/groovy/org/grails/cli/boot/SpringApplicationWebApplicationInitializer.java
+++ b/grails-shell-cli/src/main/groovy/org/grails/cli/boot/SpringApplicationWebApplicationInitializer.java
@@ -51,15 +51,28 @@ public class SpringApplicationWebApplicationInitializer extends SpringBootServle
         catch (IOException ex) {
             throw new IllegalStateException(ex);
         }
+        // This initializer only applies to CLI-packaged WARs produced by the Grails shell 'war'
+        // command, which records the application source classes in the WAR manifest via the
+        // 'Spring-Application-Source-Classes' entry. When that entry is absent (for example a
+        // standard 'bootWar' archive deployed to an external servlet container such as Tomcat),
+        // this initializer is not applicable and must stay inert so it does not interfere with
+        // the application's own SpringBootServletInitializer.
+        // See https://github.com/apache/grails-core/issues/15377
+        if (this.sources == null || this.sources.length == 0) {
+            return;
+        }
         super.onStartup(servletContext);
     }
 
     private String[] getSources(ServletContext servletContext) throws IOException {
         Manifest manifest = getManifest(servletContext);
         if (manifest == null) {
-            throw new IllegalStateException("Unable to read manifest");
+            return null;
         }
         String sources = manifest.getMainAttributes().getValue(SOURCE_ENTRY);
+        if (sources == null || sources.isBlank()) {
+            return null;
+        }
         return sources.split(",");
     }
 
diff --git a/grails-shell-cli/src/test/groovy/org/grails/cli/boot/SpringApplicationWebApplicationInitializerSpec.groovy b/grails-shell-cli/src/test/groovy/org/grails/cli/boot/SpringApplicationWebApplicationInitializerSpec.groovy
new file mode 100644
index 0000000000..8e43bb0bc0
--- /dev/null
+++ b/grails-shell-cli/src/test/groovy/org/grails/cli/boot/SpringApplicationWebApplicationInitializerSpec.groovy
@@ -0,0 +1,54 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.grails.cli.boot
+
+import jakarta.servlet.ServletContext
+import spock.lang.Specification
+
+/**
+ * Verifies that {@link SpringApplicationWebApplicationInitializer} stays inert when it is
+ * discovered on the classpath of a standard {@code bootWar} deployed to an external servlet
+ * container, i.e. when the {@code Spring-Application-Source-Classes} manifest entry is absent.
+ *
+ * Regression test for <a href="https://github.com/apache/grails-core/issues/15377">#15377</a>.
+ */
+class SpringApplicationWebApplicationInitializerSpec extends Specification {
+
+    void "onStartup is inert when the source-classes manifest entry is absent"() {
+        given: 'an initializer discovered in a non CLI-packaged WAR'
+        def initializer = new SpringApplicationWebApplicationInitializer()
+        ServletContext servletContext = Mock(ServletContext) {
+            getResourceAsStream('/META-INF/MANIFEST.MF') >> manifestStream
+        }
+
+        when: 'the servlet container invokes onStartup'
+        initializer.onStartup(servletContext)
+
+        then: 'the application boot is not disturbed and no NPE is raised'
+        noExceptionThrown()
+
+        where: 'the manifest is missing or lacks the source-classes entry'
+        manifestStream << [
+                null,
+                new ByteArrayInputStream('Manifest-Version: 1.0\r\n\r\n'.getBytes('UTF-8')),
+                new ByteArrayInputStream(
+                        'Manifest-Version: 1.0\r\nImplementation-Title: my-app\r\n\r\n'.getBytes('UTF-8'))
+        ]
+    }
+}