Simon Greatrix

CorsRegistryCORSDetector crashes with NullPointerException

1

## Environment Gradle: 5.2.1 Spotbugs: 2.0.0 FindSecBugs: 1.10.1 ## Problem Error thrown during analysis: java.lang.NullPointerException At com.h3xstream.findsecbugs.spring.CorsRegistryCORSDetector.getStringArray(CorsRegistryCORSDetector.java:62) At com.h3xstream.findsecbugs.spring.CorsRegistryCORSDetector.sawOpcode(CorsRegistryCORSDetector.java:47) At edu.umd.cs.findbugs.visitclass.DismantleBytecode.visit(DismantleBytecode.java:882) At edu.umd.cs.findbugs.visitclass.BetterVisitor.visitCode(BetterVisitor.java:218) At edu.umd.cs.findbugs.visitclass.PreorderVisitor.visitCode(PreorderVisitor.java:243) At edu.umd.cs.findbugs.bcel.OpcodeStackDetector.visitCode(OpcodeStackDetector.java:65) At org.apache.bcel.classfile.Code.accept(Code.java:132) ##...

Publishing broken by commit a7fb709 : Cannot get property 'group' on null object

4

### Shadow Version 8.1.1 ### Gradle Version 8.2.1 ### Expected Behavior Publish should not fail with a NullPointerException ### Actual Behavior ``` > Task :generatePomFileForShadowPublication FAILED FAILURE: Build failed with...

Maintenance of this repository

1

As I've been addressing peoples issues and you've not been responding to neither issues nor pull requests - would you like to add me as a maintainer of this repository...

A server using canonical JSON could be attacked by submitting a JSON object such as: ``` { "int" : 1e1000000000 } ``` This would be expanded to occupy a gigabyte...

Every "expected.json" file ends with an 0x0A new line byte. The expected output surely does not include a terminal new-line character. Whilst the extra NL character does not seem to...

Forbidden numeric character references appear in sanitized HTML

6

The HTML living standard ( https://html.spec.whatwg.org/multipage/syntax.html#character-references ) states: > The numeric character reference forms described above are allowed to reference any code point excluding U+000D CR, noncharacters, and controls other...

Whitespace affects bug detection (and false positive for NullPointerException)

2

Java version: OpenJDK 21.0.6 Gradle version: 8.12 Spotbugs plugin version: 6.1.10 I have created this simple class to demonstrate the problem: ``` import java.sql.Types; import java.util.Objects; import edu.umd.cs.findbugs.annotations.SuppressFBWarnings; import org.springframework.jdbc.core.CallableStatementCallback;...

As Spring copies the environment map on first access, I have inserted a map that decrypts the environment variables when accessed. This allows Spring to make a copy of the...

Fix: BaseDataSource.getProperty mirrors BaseDataSource.setProperty.

3

The setProperty method of BaseDataSource allows all properties to be set. The getProperty method does not allow the retrieval of: PG_HOST, PG_PORT, PG_DBNAME, USER, and PASSWORD. All properties that can...