You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@dubbo.apache.org by GitBox <gi...@apache.org> on 2021/07/01 06:52:50 UTC
[GitHub] [dubbo] containerAnalyzer opened a new issue #8194: One NPE in PropertiesConfiguration.java
containerAnalyzer opened a new issue #8194:
URL: https://github.com/apache/dubbo/issues/8194
Hello,
Our static analyzer found a following potential NPE. We have checked the feasibility of this execution trace. It is necessary to defend this vulnerability to improve the code quality.
1. Return **null** to caller (Trace staring point)
https://github.com/apache/dubbo/blob/f26ba91b67f642148a10d3b197502e29928b77bf/dubbo-common/src/main/java/org/apache/dubbo/common/extension/ExtensionLoader.java#L466
2. Function **getDefaultExtension** executes, stores the return value to **defaultextension** (**defaultextension** can be null) and return **defaultextension** to caller, which can be null
https://github.com/apache/dubbo/blob/f26ba91b67f642148a10d3b197502e29928b77bf/dubbo-common/src/main/java/org/apache/dubbo/common/extension/ExtensionLoader.java#L434
3. Return the return value of function **getExtension** to caller
https://github.com/apache/dubbo/blob/f26ba91b67f642148a10d3b197502e29928b77bf/dubbo-common/src/main/java/org/apache/dubbo/common/extension/ExtensionLoader.java#L426
4. Function **add** executes and one of the elements in **orderedPropertiesProviders** can be null
https://github.com/apache/dubbo/blob/f26ba91b67f642148a10d3b197502e29928b77bf/dubbo-common/src/main/java/org/apache/dubbo/common/config/PropertiesConfiguration.java#L40
5. Function **next** executes and stores the return value to **orderedPropertiesProvider** (**orderedPropertiesProvider** can be null)
https://github.com/apache/dubbo/blob/f26ba91b67f642148a10d3b197502e29928b77bf/dubbo-common/src/main/java/org/apache/dubbo/common/config/PropertiesConfiguration.java#L53
6. **orderedPropertiesProvider** is passed as the **this** pointer to function **initProperties** (**orderedPropertiesProvider** can be null), which will leak to null pointer dereference
https://github.com/apache/dubbo/blob/f26ba91b67f642148a10d3b197502e29928b77bf/dubbo-common/src/main/java/org/apache/dubbo/common/config/PropertiesConfiguration.java#L54
Commit: f26ba91b67f642148a10d3b197502e29928b77bf
ContainerAnalyzer
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] fangliji commented on issue #8194: One NPE in PropertiesConfiguration.java
Posted by GitBox <gi...@apache.org>.
fangliji commented on issue #8194:
URL: https://github.com/apache/dubbo/issues/8194#issuecomment-873394293
I will fix it
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] horizonzy commented on issue #8194: One NPE in PropertiesConfiguration.java
Posted by GitBox <gi...@apache.org>.
horizonzy commented on issue #8194:
URL: https://github.com/apache/dubbo/issues/8194#issuecomment-872712772
I will fix it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] horizonzy removed a comment on issue #8194: One NPE in PropertiesConfiguration.java
Posted by GitBox <gi...@apache.org>.
horizonzy removed a comment on issue #8194:
URL: https://github.com/apache/dubbo/issues/8194#issuecomment-872712772
I will fix it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] horizonzy commented on issue #8194: One NPE in PropertiesConfiguration.java
Posted by GitBox <gi...@apache.org>.
horizonzy commented on issue #8194:
URL: https://github.com/apache/dubbo/issues/8194#issuecomment-894979070
fix by #8215
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] horizonzy closed issue #8194: One NPE in PropertiesConfiguration.java
Posted by GitBox <gi...@apache.org>.
horizonzy closed issue #8194:
URL: https://github.com/apache/dubbo/issues/8194
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org