JarUrlConnection.getPermission() can throw NullPointerException if jarFileConnection is null

[yokotaso]

Thank you for developing great springframework and spring-boot ecosystem, I appreciate development.

if given resource path is not found and JavaSecurityManager is enabled, NullPointerException is thrown internally.
Not only it is simply meaningless exception,
but also it might be cause of performance regression.

StackTrace is like bellow.

java.lang.NullPointerException: Cannot invoke "java.net.URLConnection.getPermission()" because "this.jarFileConnection" is null
        at org.springframework.boot.loader.net.protocol.jar.JarUrlConnection.getPermission(JarUrlConnection.java:175)
        at java.base/jdk.internal.loader.URLClassPath.check(URLClassPath.java:553)
        at java.base/jdk.internal.loader.URLClassPath$Loader.findResource(URLClassPath.java:612)
        at java.base/jdk.internal.loader.URLClassPath.findResource(URLClassPath.java:296)
        at java.base/java.net.URLClassLoader$2.run(URLClassLoader.java:629)
        at java.base/java.net.URLClassLoader$2.run(URLClassLoader.java:627)
        at java.base/java.security.AccessController.doPrivileged(AccessController.java:399)
        at java.base/java.net.URLClassLoader.findResource(URLClassLoader.java:626)
        at org.springframework.boot.loader.net.protocol.jar.JarUrlClassLoader.findResource(JarUrlClassLoader.java:70)
        at java.base/java.lang.ClassLoader.getResource(ClassLoader.java:1403)
        at java.base/java.net.URLClassLoader.getResourceAsStream(URLClassLoader.java:290)
        at java.base/java.lang.Class.getResourceAsStream(Class.java:2850)

I got above stacktrace with using debugger around catch statement in jdk.internal.loader.URLClassPath.Loader#findResource and invoking Exception#printStackTrace()

[wilkinsona]

Thanks for the proposal but, following its deprecation in the JDK, we don't support running with the security manager enabled. Support was removed in #28213.

[philwebb]

Looking again at this one I think we probably should merge it. Although we don't support running with the security manager the getPermission() method hasn't been deprecated and we do protect other call that delegate to this.jarFileConnection to make sure it's not null.

The only thing I'm not sure about is if we can return null. The class loader implementation used to throw an exception. We could do that or return SecurityConstants.ALL_PERMISSION;.

[philwebb]

Throwing an exception looks like the best option.

[yokotaso]

@philwebb Thank you for seeing my suggestion. Sorry for the delay in noticing.

according to javadoc in java.net.URLConnection#getPermission,
it seems ok that java.net.URLConnection#getPermission returns null

Returns a permission object representing the permission
necessary to make the connection represented by this
object. This method returns null if no permission is
required to make the connection.

please comment me if I can be of any help to you.

[philwebb]

Thanks again @yokotaso. This has now been merged.