[jira] [Comment Edited] (MNG-7375) Potential NPE in o.a.m.artifact.repository.metadata.Metadata.merge(...) with invalid/incomplete plugin metadata

["Konrad Windszus (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/MNG-7375?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17846728#comment-17846728 ] 

Konrad Windszus edited comment on MNG-7375 at 5/15/24 6:15 PM:
---------------------------------------------------------------

Although true, this is due to a limitation in modello: https://github.com/codehaus-plexus/modello/blob/8467ab87f95557c8c6409f5ebe613caf240836b3/modello-plugins/modello-plugin-xsd/src/main/java/org/codehaus/modello/plugin/xsd/XsdGenerator.java#L245-L247
Compare with https://github.com/apache/maven/blob/maven-3.9.x/maven-plugin-api/src/main/mdo/plugin.mdo#L75-L80


was (Author: kwin):
Although true, this is due to a limitation in modello: https://github.com/codehaus-plexus/modello/blob/8467ab87f95557c8c6409f5ebe613caf240836b3/modello-plugins/modello-plugin-xsd/src/main/java/org/codehaus/modello/plugin/xsd/XsdGenerator.java#L245-L247

> Potential NPE in o.a.m.artifact.repository.metadata.Metadata.merge(...) with invalid/incomplete plugin metadata
> ---------------------------------------------------------------------------------------------------------------
>
>                 Key: MNG-7375
>                 URL: https://issues.apache.org/jira/browse/MNG-7375
>             Project: Maven
>          Issue Type: Improvement
>          Components: Artifacts and Repositories
>    Affects Versions: 3.8.4
>            Reporter: Konrad Windszus
>            Priority: Major
>         Attachments: NEXUS-30749 - Broken groupId metadata and follow-up NPE during org.sonatype.nexus.maven.staging.deploy.strategy.AbstractDeployStrategy.deployUp - Sonatype JIRA.pdf
>
>
> Currently the metadata at https://repository.apache.org/service/local/repositories/snapshots/content/org/apache/jackrabbit/maven-metadata.xml contains an invalid entry without a prefix:
> {code:xml}
> <metadata>
>   <plugins>
>     <plugin>
>       <name>Apache Jackrabbit FileVault - Package Maven Plugin</name>
>       <prefix>filevault-package</prefix>
>       <artifactId>filevault-package-maven-plugin</artifactId>
>     </plugin>
>     <plugin>
>       <name>filevault-package-maven-plugin</name>
>       <artifactId>filevault-package-maven-plugin</artifactId>
>     </plugin>
>   </plugins>
> </metadata>
> {code}
> This leads to an NPE when trying to deploy a new version with {{org.apache.maven.artifact.deployer.DefaultArtifactDeployer.deploy(...)}}:
> {noformat}
> Caused by: java.lang.NullPointerException
>     at org.apache.maven.artifact.repository.metadata.Metadata.merge (Metadata.java:276)
>     at org.apache.maven.artifact.repository.metadata.AbstractRepositoryMetadata.updateRepositoryMetadata (AbstractRepositoryMetadata.java:121)
>     at org.apache.maven.artifact.repository.metadata.AbstractRepositoryMetadata.storeInLocalRepository (AbstractRepositoryMetadata.java:67)
>     at org.apache.maven.artifact.repository.metadata.MetadataBridge.merge (MetadataBridge.java:65)
>     at org.eclipse.aether.internal.impl.DefaultDeployer.upload (DefaultDeployer.java:433)
>     at org.eclipse.aether.internal.impl.DefaultDeployer.deploy (DefaultDeployer.java:321)
>     at org.eclipse.aether.internal.impl.DefaultDeployer.deploy (DefaultDeployer.java:213)
>     at org.eclipse.aether.internal.impl.DefaultRepositorySystem.deploy (DefaultRepositorySystem.java:386)
>     at org.apache.maven.artifact.deployer.DefaultArtifactDeployer.deploy (DefaultArtifactDeployer.java:142)
> {noformat}
> Although this happened in the context of using "[org.sonatype.plugins:nexus-staging-maven-plugin|https://github.com/sonatype/nexus-maven-plugins]:1.6.8" (issue https://issues.sonatype.org/browse/NEXUS-30749 opened, exported to  [^NEXUS-30749 - Broken groupId metadata and follow-up NPE during org.sonatype.nexus.maven.staging.deploy.strategy.AbstractDeployStrategy.deployUp - Sonatype JIRA.pdf] ), the affected code is in Maven.
> The metadata is probably invalid but the Metadata class should be more robust when trying to do the merge in https://github.com/apache/maven/blob/951b5ee95f40147abbc2bb9d928e408b85d5aef3/maven-repository-metadata/src/main/mdo/metadata.mdo#L100 and just ignore all plugin entries without all mandatory elements.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)