NPE in EndpointRequestMatcher.matches

[wilkinsona]

Courtesy of @ptahchiev:

java.lang.NullPointerException
    at org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest$EndpointRequestMatcher.matches(EndpointRequest.java:191)
    at org.springframework.boot.security.servlet.ApplicationContextRequestMatcher.matches(ApplicationContextRequestMatcher.java:57)
    at org.springframework.security.web.DefaultSecurityFilterChain.matches(DefaultSecurityFilterChain.java:57)
    at org.springframework.security.web.FilterChainProxy.getFilters(FilterChainProxy.java:226)
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:198)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:357)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270)

The problem's in ApplicationContextRequestMatcher, which EndpointRequestMatcher extends:

private Supplier<C> getContext(HttpServletRequest request) {
	if (this.context == null) {
		synchronized (this.contextLock) {
			if (this.context == null) {
				this.context = createContext(request);
				initialized(this.context);
			}
		}
	}
	return this.context;
}

If two threads call getContext at roughly the same time, there's a window where this.context is no longer null but when initialized hasn't been called or is still in the process of being called. In the case of EndpointRequestMatcher, this leads to matches being called while this.delegate is still null. The problem's exacerbated by this.delegate not being volatile so there's a visibility problem too.

[jacum]

This doesn't seem to be solved.
We use Spring Boot 2.2.0.M6 and it fails with

2019-09-13 12:36:35,393 ERROR [org.apache.catalina.core.ContainerBase.[Tomcat].[localhost].[/].[dispatcherServlet]] - <Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception>
java.lang.NullPointerException: null
	at org.springframework.boot.autoconfigure.security.servlet.StaticResourceRequest$StaticResourceRequestMatcher.matches(StaticResourceRequest.java:156) ~[spring-boot-autoconfigure-2.2.0.M6.jar!/:2.2.0.M6]
	at org.springframework.boot.security.servlet.ApplicationContextRequestMatcher.matches(ApplicationContextRequestMatcher.java:65) ~[spring-boot-2.2.0.M6.jar!/:2.2.0.M6]
	at org.springframework.security.web.access.intercept.DefaultFilterInvocationSecurityMetadataSource.getAttributes(DefaultFilterInvocationSecurityMetadataSource.java:95) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:197) ~[spring-security-core-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:124) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:118) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:158) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.2.0.RC2.jar!/:5.2.0.RC2]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.access.channel.ChannelProcessingFilter.doFilter(ChannelProcessingFilter.java:157) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178) ~[spring-security-web-5.2.0.RC1.jar!/:5.2.0.RC1]
	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358) ~[spring-web-5.2.0.RC2.jar!/:5.2.0.RC2]
	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271) ~[spring-web-5.2.0.RC2.jar!/:5.2.0.RC2]

This is very reliably reproduced on a very first request to the application, just started.
Looks like

private volatile RequestMatcher delegate;

doesn't get initialised yet (initalized() method is not called yet) when delegate.matches is called.

[snicoll]

@jacum isn't that a separate issue rather? See #18211

[jacum]

@snicoll ehm, maybe... but they both look similar enough.

[philwebb]

@jacum It's an unfortunate regression, we'll use #18211 to track the fix in 2.1.8 since this issues already closed.