Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVOC: Fix NPE #10603

Merged
merged 3 commits into from
Jun 21, 2024
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@

import org.apache.commons.codec.digest.DigestUtils;
import org.apache.commons.httpclient.HttpException;
import org.apache.commons.lang3.StringUtils;
import org.apache.http.HttpResponse;
import org.apache.http.HttpResponseInterceptor;
import org.apache.http.client.methods.HttpGet;
Expand Down Expand Up @@ -561,6 +562,10 @@ public void process(HttpResponse response, HttpContext context) throws HttpExcep

private String replaceRetrievalUriParam(String retrievalUri, String paramName, String value) {

if(StringUtils.isBlank(paramName) || StringUtils.isBlank(value)) {
return retrievalUri;
}

Copy link
Member

@qqmyers qqmyers May 31, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems like line 501 above is the only thing that could cause the NPE? And in that case the paramName can't be null but the value could be? I wonder if checking on line 571 to see if retrievalUri.contains(paramName) would be a better check - if the param name is in the Uri and it isn't replaced, that's a problem you wouldn't want to silently ignore? Or do you in the free text case? Seems like the code shouldn't just call the remote service with a broken URL, so maybe the NPE should be caught and used to avoid the call to the service instead?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CVOC is sooo complexe...

  • you are right the only case where there is NPE can happen is : L501 retrievalUri = replaceRetrievalUriParam(retrievalUri, f.getDatasetFieldType().getName(), f.getValue()); when value is null which can happen with termUri filled but when a parameter set in retrievalUri has no value.
  • retrievalUri.contains(paramName) would be a better check - if the param name is in the Uri and it isn't replaced, that's a problem you wouldn't want to silently ignore if param is null, empty or wrong I just do nothing, either it cannot be done, data are wrong or json setting is wrong. But that being said, a "if paramName does not exist in retrievalUri then logger.warning" can be done.
  • the code shouldn't just call the remote service with a broken URL, so maybe the NPE should be caught and used to avoid the call to the service instead? hum, you are right, for a wrong parameter we could simply return; instead of performing the call.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@qqmyers 79b8d89 modifications have been made, if you can review / approve :)

if(retrievalUri.contains("encodeUrl:" + paramName)) {
retrievalUri = retrievalUri.replace("{encodeUrl:"+paramName+"}", URLEncoder.encode(value, StandardCharsets.UTF_8));
} else {
Expand Down
Loading