Description
msg.payload().passwordInBytes() returns null for any CONNECT whose connect-flags password bit is 0 (valid MQTT client — anonymous or username-only). It is passed into MqttContext.isValid, which calls new String((byte[]) null) → NPE.
Location
shenyu-protocol/shenyu-protocol-mqtt/src/main/java/org/apache/shenyu/protocol/mqtt/Connect.java:60-62shenyu-protocol/shenyu-protocol-mqtt/src/main/java/org/apache/shenyu/protocol/mqtt/MqttContext.java:48
Impact
Handler thread throws; client never receives a CONNACK and the connection hangs.
Suggested fix
Null-check passwordInBytes in MqttContext.isValid (treat null as empty).
Related existing
Distinct from MQTT-09 (#6748, charset decoding of a non-null password) — this is a null-deref on a missing password.
Description
msg.payload().passwordInBytes()returns null for any CONNECT whose connect-flags password bit is 0 (valid MQTT client — anonymous or username-only). It is passed intoMqttContext.isValid, which callsnew String((byte[]) null)→ NPE.Location
shenyu-protocol/shenyu-protocol-mqtt/src/main/java/org/apache/shenyu/protocol/mqtt/Connect.java:60-62shenyu-protocol/shenyu-protocol-mqtt/src/main/java/org/apache/shenyu/protocol/mqtt/MqttContext.java:48Impact
Handler thread throws; client never receives a CONNACK and the connection hangs.
Suggested fix
Null-check
passwordInBytesinMqttContext.isValid(treat null as empty).Related existing
Distinct from MQTT-09 (#6748, charset decoding of a non-null password) — this is a null-deref on a missing password.