(tomcat) 01/18: Avoid NPE in SimpleInstanceManager.newInstance(String) with null TCCL

[re...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rmaucher pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit 1c598555f222a91f700897b96d8c165cc6fa8e9e
Author: opencode <re...@apache.org>
AuthorDate: Wed Oct 14 09:38:16 2026 +0200

    Avoid NPE in SimpleInstanceManager.newInstance(String) with null TCCL
    
    SimpleInstanceManager.newInstance(String) dereferenced the thread
    context class loader without a null check. Thread.getContextClassLoader()
    is documented to return null in some cases and NullPointerException is not
    part of the InstanceManager.newInstance(String) contract, so a raw NPE
    could escape to callers.
    
    Fall back to the class loader of SimpleInstanceManager when the thread
    context class loader is null, matching the established pattern used by
    JspRuntimeContext and Registry. This turns the previous undeclared NPE
    into the contract-declared ClassNotFoundException when the class cannot
    be resolved, and has no effect on the normal case where the thread
    context class loader is set.
---
 java/org/apache/tomcat/SimpleInstanceManager.java | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/java/org/apache/tomcat/SimpleInstanceManager.java b/java/org/apache/tomcat/SimpleInstanceManager.java
index 8988289d2c..417e942270 100644
--- a/java/org/apache/tomcat/SimpleInstanceManager.java
+++ b/java/org/apache/tomcat/SimpleInstanceManager.java
@@ -43,7 +43,11 @@ public class SimpleInstanceManager implements InstanceManager {
     @Override
     public Object newInstance(String className) throws IllegalAccessException, InvocationTargetException,
             NamingException, InstantiationException, ClassNotFoundException, NoSuchMethodException {
-        Class<?> clazz = Thread.currentThread().getContextClassLoader().loadClass(className);
+        ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
+        if (classLoader == null) {
+            classLoader = SimpleInstanceManager.class.getClassLoader();
+        }
+        Class<?> clazz = classLoader.loadClass(className);
         return clazz.getConstructor().newInstance();
     }
 


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org