From 85ce71217b294991df5d82d5676e3707037fdf20 Mon Sep 17 00:00:00 2001
From: julian-computes <jufer002.work@gmail.com>
Date: Wed, 26 Oct 2022 08:53:30 -0400
Subject: [PATCH] [SHIRO-893] Fix NPE in ShiroFilter.init()

In 1.10.0, an NPE can be thrown because DefaultWebEnvironment has no default value for ShiroFilterConfiguration. This commit adds a default value determined by WebEnvironment.getShiroFilterConfiguration().
---
 .../shiro/web/env/DefaultWebEnvironment.java  |  8 +++++++-
 .../web/env/EnvironmentLoaderServiceTest.java | 20 +++++++++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/web/src/main/java/org/apache/shiro/web/env/DefaultWebEnvironment.java b/web/src/main/java/org/apache/shiro/web/env/DefaultWebEnvironment.java
index 7ce3d870e6..e67903188e 100644
--- a/web/src/main/java/org/apache/shiro/web/env/DefaultWebEnvironment.java
+++ b/web/src/main/java/org/apache/shiro/web/env/DefaultWebEnvironment.java
@@ -97,6 +97,12 @@ public void setShiroFilterConfiguration(ShiroFilterConfiguration filterConfigura
 
     @Override
     public ShiroFilterConfiguration getShiroFilterConfiguration() {
-        return getObject(SHIRO_FILTER_CONFIG_NAME, ShiroFilterConfiguration.class);
+        ShiroFilterConfiguration config = getObject(SHIRO_FILTER_CONFIG_NAME, ShiroFilterConfiguration.class);
+        // Use the default configuration if config is null
+        if (config == null) {
+            config = MutableWebEnvironment.super.getShiroFilterConfiguration();
+            setShiroFilterConfiguration(config);
+        }
+        return config;
     }
 }
diff --git a/web/src/test/java/org/apache/shiro/web/env/EnvironmentLoaderServiceTest.java b/web/src/test/java/org/apache/shiro/web/env/EnvironmentLoaderServiceTest.java
index 9a45d20d9a..db4eb5b3b1 100644
--- a/web/src/test/java/org/apache/shiro/web/env/EnvironmentLoaderServiceTest.java
+++ b/web/src/test/java/org/apache/shiro/web/env/EnvironmentLoaderServiceTest.java
@@ -30,6 +30,8 @@
 import static org.easymock.EasyMock.expect;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.instanceOf;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.notNullValue;
 import static org.hamcrest.Matchers.sameInstance;
 import static org.hamcrest.Matchers.stringContainsInOrder;
 import static org.mockito.Mockito.mock;
@@ -63,6 +65,24 @@ public void singleServiceTest() throws Exception {
         assertThat(environmentStub.getServletContext(), sameInstance(servletContext));
     }
 
+    @Test
+    public void testDefaultWebEnvironment() {
+        ServletContext servletContext = EasyMock.mock(ServletContext.class);
+        expect(servletContext.getInitParameter("shiroEnvironmentClass"))
+                .andReturn(DefaultWebEnvironment.class.getName());
+        expect(servletContext.getInitParameter("shiroConfigLocations")).andReturn(null);
+
+        EasyMock.replay(servletContext);
+
+        WebEnvironment environment = new EnvironmentLoader().createEnvironment(servletContext);
+
+        EasyMock.verify(servletContext);
+
+        assertThat(environment, instanceOf(DefaultWebEnvironment.class));
+        assertThat(environment.getShiroFilterConfiguration(), is(notNullValue()));
+        assertThat(environment.getServletContext(), sameInstance(servletContext));
+    }
+
     @Test()
     public void multipleServiceTest() throws Exception {