NullPointerException when SecurityEntityFilteringFeature enabled

[glassfishrobot]

Hi,

I enabled SecurityEntityFilteringFeature. When I test a 406 due to a not supported media-type I get a NullPointerException thrown by ServerScopeProvider.getFilteringScopes because the getMatchedMethods() returns a null

for (final ResourceMethod method : ServerScopeProvider.getMatchedMethods(uriInfo)) {
final Invocable invocable = method.getInvocable();

mergeFilteringScopes(filteringScope,
        getFilteringScopes(invocable.getHandlingMethod(), invocable.getHandler().getHandlerClass()));

if (!filteringScope.isEmpty()) {
    uriToContexts.putIfAbsent(path, filteringScope);
    return filteringScope;
}
            }

How can I tell Jersey to execute this feature only if I return a 200

Affected Versions

[2.17]

[glassfishrobot]

Reported by raphael_c

[glassfishrobot]

@AdamLindenthal said: Thanks for reporting. This indeed looks like a bug. Putting it to backlog.

Regards, Adam

[glassfishrobot]

@shamoh said: Please provide reproducible test case.

[glassfishrobot]

raphael_c said: Hi,

To reproduce this you need a jersey application with the module declared in your ResourceConfig, then write a simple GET resource consuming only text/plain.

Once your app is running, invoke the simple resource with a different media-type. The app detects the wrong media-type then return a 406 which is intercepted by the plugin and causes the following error.

Tell me if you want more details.

Regards,

[glassfishrobot]

@shamoh said: Could you provide running JerseyTest simple app?

[glassfishrobot]

This issue was imported from java.net JIRA JERSEY-2859

[helospark]

I have also experienced a 500 error similar to this, I think it is related:

Registering EntityFilteringFeature and returning a custom JSON response body for any 404 URL will return 500 errors with a NullPointerException in the stacktrace.

I have created a simple program to repro that behavior using Spring Boot and Jersey: https://github.com/helospark/jersey-3131-repro/tree/master/jersey-demo-500

To reproduce, you can just run the JerseyTest class as a JUnit test, not existent URI should return 404 instead of 500.

As far as I understand, this happens, because when the EntityFilteringFeature is registered FilteringJacksonJaxbJsonProvider is used instead of JacksonJaxbJsonProvider and that tries to get the currently matched resource, which obviously does not exist when the URL is 404 causing the NPE.

This seems like a regression bug, since we did not experience the same behavior with version 2.8 but happens with version 2.24 and 2.25.1 (and possibly other versions as well).

Note: I just use Spring Boot for simple repro, but happens without Boot as well.