[I] NPE in getCommandlineInfo() when storepass/keypass is null [maven-jarsigner-plugin]

["elharo (via GitHub)" <gi...@apache.org>]

elharo opened a new issue, #145:
URL: https://github.com/apache/maven-jarsigner-plugin/issues/145

   **Affected version:** HEAD
   
   **Files:** 
   - `src/main/java/org/apache/maven/plugins/jarsigner/AbstractJarsignerMojo.java:376`
   - `src/main/java/org/apache/maven/plugins/jarsigner/JarsignerSignMojo.java:251`
   
   Both `getCommandlineInfo()` methods call `StringUtils.replace(commandLineInfo, this.storepass/keypass, mask)` where the password field can be null when the user hasn't configured a `storepass` or `keypass`:
   
   ```java
   // AbstractJarsignerMojo.java:376
   commandLineInfo = StringUtils.replace(commandLineInfo, this.storepass, "'*****'");
   
   // JarsignerSignMojo.java:251
   commandLineInfo = StringUtils.replace(commandLineInfo, this.keypass, "'*****'");
   ```
   
   If `StringUtils.replace` delegates to `String.replace(CharSequence, CharSequence)` (which throws NPE on null target), this crashes whenever jarsigner returns a non-zero exit code and tries to log the command line, but the user hasn't set a password.
   
   The fix should guard the call: only attempt replacement when the password is non-null.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org