[TOMEE-1865] NPE when injected request used in bean called from JASPIC SAM

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 7.0.1
• Fix Version/s: 7.0.2
• Component/s: TomEE Core Server
• Labels: security
• Assignee: Romain Manni-Bucau
• Reporter: Arjan Tijms
• Created: 12/Jul/16 23:41
• Updated: 13/Jul/16 09:47
• Resolved: 13/Jul/16 05:42

Description

When a CDI bean is called from a JASPIC SAM (validateRequest or secureResponse), and this bean has an injected HttpServletRequest, then a proxy is indeed injected, but when any method is called on this proxy a NullPointerException is thrown:

java.lang.NullPointerException
	at sun.reflect.GeneratedMethodAccessor43.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.apache.openejb.cdi.Proxys$ThreadLocalHandler.invoke(Proxys.java:95)
	at com.sun.proxy.$Proxy15.setAttribute(Unknown Source)
	at org.javaee7.jaspic.invoke.bean.CDIBean.setTextViaInjectedRequest(CDIBean.java:20)
	at org.javaee7.jaspic.invoke.bean.CDIBean$$OwbNormalScopeProxy0.setTextViaInjectedRequest(org/javaee7/jaspic/invoke/bean/CDIBean.java)
	at org.javaee7.jaspic.invoke.sam.TestServerAuthModule.callCDIBean(TestServerAuthModule.java:113)
	at org.javaee7.jaspic.invoke.sam.TestServerAuthModule.validateRequest(TestServerAuthModule.java:57)
	at org.javaee7.jaspic.common.TestServerAuthContext.validateRequest(TestServerAuthContext.java:36)
	at org.apache.catalina.authenticator.AuthenticatorBase.authenticate(AuthenticatorBase.java:706)
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:599)

The same exception is thrown when a SAM doesn't call a CDI bean directly, but forwards to a Servlet, which is injected with the same kind of CDI bean.

For using the bean directly from a SAM I've extended the existing test case here: https://github.com/javaee-samples/javaee7-samples/tree/master/jaspic/invoke-ejb-cdi

The expected output is:

validateRequest: Called from CDI
validateRequest: Called from CDI via injected request
Resource invoked
cleanSubject: Called from CDI
cleanSubject: Called from CDI via injected request
secureResponse: Called from CDI
secureResponse: Called from CDI via injected request

But on TomEE 7.0.1 it's:

validateRequest: Called from CDI
Resource invoked
cleanSubject: Called from CDI
cleanSubject: Called from CDI via injected request
secureResponse: Called from CDI

On JBoss EAP 7/WildFly 10.0.0 and Payara 4.1.1.162 the output is as expected.

The CDI bean looks as follows:

@Named
@RequestScoped
public class CDIBean {
    
    @Inject
    private HttpServletRequest request;

    public String getText() {
        return "Called from CDI";
    }
    
    public void setTextViaInjectedRequest() {
        request.setAttribute("text", "Called from CDI via injected request");
    }
    
}

The call to this bean from a SAM is essentially this:

CDIBean cdiBean = CDI.current().select(CDIBean.class).get();
cdiBean.setTextViaInjectedRequest();

Issue Links

• duplicates: TOMEE-1866 Authenticators don't have access to the request in CDI beans (@RequestScoped)