[MENFORCER-481] Omission of `excludedScopes` parameter of `banDynamicVersions` causes NPE

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.3.0
• Fix Version/s: 3.4.0
• Component/s: banDynamicVersions
• Assignee: Slawomir Jaranowski
• Reporter: Stephan Schroevers
• Created: 29/Apr/23 13:52
• Updated: 17/May/23 16:08
• Resolved: 30/Apr/23 11:21

Description

The new banDynamicVersions declares an optional excludedScopes parameter, but omitting it causes an NPE:

Caused by: java.lang.NullPointerException: Cannot invoke "java.util.List.contains(Object)" because "excludedScopes" is null
    at org.apache.maven.enforcer.rules.dependency.ResolverUtil.lambda$resolveTransitiveDependencies$1 (ResolverUtil.java:133)
    at java.util.stream.ReferencePipeline$2$1.accept (ReferencePipeline.java:178)
    at java.util.stream.ReferencePipeline$2$1.accept (ReferencePipeline.java:179)
    at java.util.ArrayList$ArrayListSpliterator.forEachRemaining (ArrayList.java:1625)
    at java.util.stream.AbstractPipeline.copyInto (AbstractPipeline.java:509)
    at java.util.stream.AbstractPipeline.wrapAndCopyInto (AbstractPipeline.java:499)
    at java.util.stream.ReduceOps$ReduceOp.evaluateSequential (ReduceOps.java:921)
    at java.util.stream.AbstractPipeline.evaluate (AbstractPipeline.java:234)
    at java.util.stream.ReferencePipeline.collect (ReferencePipeline.java:682)
    at org.apache.maven.enforcer.rules.dependency.ResolverUtil.resolveTransitiveDependencies (ResolverUtil.java:135)
    at org.apache.maven.enforcer.rules.dependency.ResolverUtil.resolveTransitiveDependencies (ResolverUtil.java:110)
    at org.apache.maven.enforcer.rules.dependency.BanDynamicVersions.execute (BanDynamicVersions.java:198)
    at org.apache.maven.plugins.enforcer.EnforceMojo.executeRuleNew (EnforceMojo.java:351)
    at org.apache.maven.plugins.enforcer.EnforceMojo.executeRule (EnforceMojo.java:325)
    at org.apache.maven.plugins.enforcer.EnforceMojo.execute (EnforceMojo.java:248)
    ...

To reproduce the issue, check out this PR and apply the following patch:

diff --git a/pom.xml b/pom.xml
index b26ec1b7..8f013bcc 100644
--- a/pom.xml
+++ b/pom.xml
@@ -989,11 +989,6 @@
                                 <!-- XXX: Drop this once the `ignores` section
                                 below works as expected. -->
                                 <allowSnapshots>true</allowSnapshots>
-                                <!-- XXX: It shouldn't be necessary to specify
-                                an empty `excludedScopes` parameter, but
-                                without this an NPE results. See
-                                https://issues.apache.org/jira/browse/MENFORCER-481. -->
-                                <excludedScopes />
                                 <!-- XXX: This doesn't work. See
                                 https://issues.apache.org/jira/browse/MENFORCER-480.
                                 <ignores>

Now running mvn clean package will cause a build failure.

The following Maven Enforcer change resolves the issue:

diff --git a/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/BanDynamicVersions.java b/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/BanDynamicVersions.java
index 7224b84..5a827c8 100644
--- a/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/BanDynamicVersions.java
+++ b/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/BanDynamicVersions.java
@@ -99,7 +99,7 @@ public final class BanDynamicVersions extends AbstractStandardEnforcerRule {
     /**
      * the scopes of dependencies which should be excluded from this rule
      */
-    private List<String> excludedScopes;
+    private List<String> excludedScopes = Collections.emptyList();
 
     /**
      * Specify the ignored dependencies. This can be a list of artifacts in the format

Issue Links

• is duplicated by: MENFORCER-483 excludedScopes should use the default value
• links to: GitHub Pull Request #270