[OFBIZ-11385] Possible NPE in DatabaseUtil.getColumnInfo(...)

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Trunk
• Fix Version/s: 18.12.01, Upcoming Branch
• Component/s: framework/webtools
• Assignee: Michael Brohl
• Reporter: Benjamin Jugl
• Created: 21/Feb/20 15:54
• Updated: 01/Feb/21 16:45
• Resolved: 01/Feb/21 16:45

Description

Right at the start DatabaseUtil.getColumnInfo(....) does an if comparison to 0 with the unchecked parameter tableNames.

The way this method and especially the parameter is used in DatabaseUtil.induceModelFromDb(Collection<String> messages) is not secure to not provide null-values for this parameter.

I suggest using a UtilValidate.isEmpty(...) instead of the unsave comparison.

Issue Links

• links to: GitHub Pull Request #256