<p dir="auto"><strong><a href="https://jira.spring.io/secure/ViewProfile.jspa?name=croudet" rel="nofollow">Christophe Roudet</a></strong> opened <strong><a href="https://jira.spring.io/browse/SPR-7686?redirect=false" rel="nofollow">SPR-7686</a></strong> and commented</p>
<p dir="auto">When using SpringBeanAutowiringSupport.processInjectionBasedOnServletContext()<br>
a NullPointerException is raised in<br>
InjectionMetadata.checkPropertySkipping(PropertyValues pvs)</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="protected boolean checkPropertySkipping(PropertyValues pvs) {
  if (this.skip == null) {
    synchronized (pvs) { // &lt;-- NullPointerException
      if (this.skip == null) {"><pre class="notranslate"><code class="notranslate">protected boolean checkPropertySkipping(PropertyValues pvs) {
  if (this.skip == null) {
    synchronized (pvs) { // &lt;-- NullPointerException
      if (this.skip == null) {
</code></pre></div>
<p dir="auto">in AutowiredAnnotationBeanPostProcessor.processInjection(Object bean)<br>
metadata inject is called with null for PropertyValues</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="public void processInjection(Object bean) throws BeansException {
  Class&lt;?&gt; clazz = bean.getClass();
  InjectionMetadata metadata = findAutowiringMetadata(clazz);
  try {
    metadata.inject(bean, null, null); // &lt;-- pvs is null
  }
  catch (Throwable ex) {
    throw new BeanCreationException(&quot;Injection of autowired dependencies failed for class [&quot; + clazz + &quot;]&quot;, ex);
  }
}"><pre class="notranslate"><code class="notranslate">public void processInjection(Object bean) throws BeansException {
  Class&lt;?&gt; clazz = bean.getClass();
  InjectionMetadata metadata = findAutowiringMetadata(clazz);
  try {
    metadata.inject(bean, null, null); // &lt;-- pvs is null
  }
  catch (Throwable ex) {
    throw new BeanCreationException("Injection of autowired dependencies failed for class [" + clazz + "]", ex);
  }
}
</code></pre></div>
<p dir="auto">Here is the stack trace:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="java.lang.NullPointerException
 	at org.springframework.beans.factory.annotation.InjectionMetadata$InjectedElement.checkPropertySkipping(InjectionMetadata.java:171)
 	at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredMethodElement.inject(AutowiredAnnotationBeanPostProcessor.java:526)
 	at org.springframework.beans.factory.annotation.InjectionMetadata.inject(InjectionMetadata.java:84)
 	at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.processInjection(AutowiredAnnotationBeanPostProcessor.java:300)
 	at org.springframework.web.context.support.SpringBeanAutowiringSupport.processInjectionBasedOnServletContext(SpringBeanAutowiringSupport.java:110)"><pre class="notranslate"><code class="notranslate">java.lang.NullPointerException
 	at org.springframework.beans.factory.annotation.InjectionMetadata$InjectedElement.checkPropertySkipping(InjectionMetadata.java:171)
 	at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredMethodElement.inject(AutowiredAnnotationBeanPostProcessor.java:526)
 	at org.springframework.beans.factory.annotation.InjectionMetadata.inject(InjectionMetadata.java:84)
 	at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.processInjection(AutowiredAnnotationBeanPostProcessor.java:300)
 	at org.springframework.web.context.support.SpringBeanAutowiringSupport.processInjectionBasedOnServletContext(SpringBeanAutowiringSupport.java:110)
</code></pre></div>
<hr>
<p dir="auto"><strong>Affects:</strong> 3.0.5</p>
<p dir="auto"><strong>Issue Links:</strong></p>
<ul dir="auto">
<li><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="398108345" data-permission-text="Title is private" data-url="https://github.com/spring-projects/spring-framework/issues/12344" data-hovercard-type="issue" data-hovercard-url="/spring-projects/spring-framework/issues/12344/hovercard" href="https://github.com/spring-projects/spring-framework/issues/12344">#12344</a> NullPointerException could be thrown on  synchronized (pvs) in InjectionMetadata.checkPropertySkipping (<em><strong>"is duplicated by"</strong></em>)</li>
<li><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="398108009" data-permission-text="Title is private" data-url="https://github.com/spring-projects/spring-framework/issues/12291" data-hovercard-type="issue" data-hovercard-url="/spring-projects/spring-framework/issues/12291/hovercard" href="https://github.com/spring-projects/spring-framework/issues/12291">#12291</a> Unresolved thread safety issue in AutowiredAnnotationBeanPostProcessor.AutowiredMethodElement</li>
</ul>
<p dir="auto"><strong>Referenced from:</strong> commits <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/spring-projects/spring-framework/commit/9c64ac7482fde7bd8f2893eec29870588fcdcd04/hovercard" href="https://github.com/spring-projects/spring-framework/commit/9c64ac7482fde7bd8f2893eec29870588fcdcd04"><tt>9c64ac7</tt></a></p>
<p dir="auto">1 votes, 4 watchers</p>
<p dir="auto"><strong><a href="https://jira.spring.io/secure/ViewProfile.jspa?name=cnelson" rel="nofollow">Christian Nelson</a></strong> opened <strong><a href="https://jira.spring.io/browse/SPR-1899?redirect=false" rel="nofollow">SPR-1899</a></strong> and commented</p>
<p dir="auto">I would like to see an analog to the DataBinder.setAllowedField(String[]) called setIgnoredFields(String[]) or setDisallowedFields(String[]).</p>
<p dir="auto">In most scenarios, there are fewer fields to ignore than to allow.  Almost all of my command objects have only one field that isn't allowed (id), though some of them might have a second if there's an id-based weak reference to another object.  In any case, it seems to me that it's more developer friendly to support setting which properties should <strong>not</strong> be allowed.</p>
<p dir="auto">There is some discussion around this issue on the forums ( <a href="http://forum.springframework.org/showthread.php?t=10820" rel="nofollow">http://forum.springframework.org/showthread.php?t=10820</a> ).  Darren's point about "false sense of security" is valid, but the default behavior already gives a flase sense of security because everything is bound.  I think it's important to make developers' jobs easy, and let them take responsility for their own code (instead of assuming users don't know what they're doing).  By adding this setIgnored/Disallowed feature, each developer could decide when to use each version.</p>
<p dir="auto">The only complication is if the user calls setAllowedFields(new String[] { "name", "address", "age" }) <strong>and</strong> setIgnoredFields(new String[] { "id", "name" }), which is clearly a mistake.  Perhaps only one approach can be used for a particular form instance?</p>
<p dir="auto">It wouldn't be difficult to create a new subclass of ServletRequestDataBinder to support this, but it's difficult to plug in the new binder because BaseCommandController.createBinder(HttpServletRequest request, Object command) does more than just create an instance, it also sets a number of important settings on the ServletRequestDataBinder.</p>
<p dir="auto">I recommend either adding native support for ignored fields to DataBinder or one of it's subclasses, or make it easier to plug in a new subclass of ServletRequestDataBinder by seperating the creation of the ServletRequestDataBinder and the initialization that takes place in the current createBinder method.</p>
<p dir="auto">Thanks,<br>
Christian</p>
<hr>
<p dir="auto"><strong>Affects:</strong> 1.2.7, 2.0 M3</p>
<p dir="auto"><strong>Attachments:</strong></p>
<ul dir="auto">
<li><a href="https://jira.spring.io/secure/attachment/11575/SpecialServletRequestDataBinder.java" rel="nofollow">SpecialServletRequestDataBinder.java</a> (<em>988 bytes</em>)</li>
<li><a href="https://jira.spring.io/secure/attachment/11576/SpecialServletRequestDataBinderTest.java" rel="nofollow">SpecialServletRequestDataBinderTest.java</a> (<em>1.46 kB</em>)</li>
</ul>