One NPE in dubbo/container/Main.java

[containerAnalyzer]

Hello,
Our static analyzer found a following potential NPE. We have checked the feasibility of this execution trace. It is necessary to defend this vulnerability to improve the code quality.

1. Return null to caller (Trace staring point)
   

   dubbo/dubbo-common/src/main/java/org/apache/dubbo/common/extension/ExtensionLoader.java

   Line 466 in f26ba91

   return null;

2. Function getDefaultExtension executes, stores the return value to defaultextension (defaultextension can be null) and return defaultextension to caller, which can be null
   

   dubbo/dubbo-common/src/main/java/org/apache/dubbo/common/extension/ExtensionLoader.java

   Line 434 in f26ba91

   return getDefaultExtension();

3. Return the return value of function getExtension to caller
   

   dubbo/dubbo-common/src/main/java/org/apache/dubbo/common/extension/ExtensionLoader.java

   Line 426 in f26ba91

   return getExtension(name, true);

4. Function getExtension executes and stores the return value to extension (extension can be null)
   

   dubbo/dubbo-container/dubbo-container-api/src/main/java/org/apache/dubbo/container/Main.java

   Line 63 in f26ba91

   containers.add(LOADER.getExtension(args[i]));

5. Function add executes and containers contains null as its elements.
   

   dubbo/dubbo-container/dubbo-container-api/src/main/java/org/apache/dubbo/container/Main.java

   Line 63 in f26ba91

   containers.add(LOADER.getExtension(args[i]));

6. Function next executes and return null value
   

   dubbo/dubbo-container/dubbo-container-api/src/main/java/org/apache/dubbo/container/Main.java

   Line 89 in f26ba91

   for (Container container : containers) {

7. The return value of function next is passed as the this pointer to function start (the return value of function next can be null), which will leak to null pointer dereference
   

   dubbo/dubbo-container/dubbo-container-api/src/main/java/org/apache/dubbo/container/Main.java

   Line 90 in f26ba91

   container.start();

Commit: f26ba91

ContainerAnalyzer

[howie-xu]

I will fix it.

[colin-ife-snyk]

Any update on this? Has it been fixed yet?

[wangchengming666]

I will fix it.

[howie-xu]

It has already been fixed by #8215

[wangchengming666]

It has already been fixed by #8215

ok

[wangchengming666]

@containerAnalyzer pls close issue