Describe the bug
The null check in AbstractUserDetailsReactiveAuthenticationManager#setPostAuthenticationChecks asserts the current field value instead of the parameter:
public void setPostAuthenticationChecks(UserDetailsChecker postAuthenticationChecks) {
Assert.notNull(this.postAuthenticationChecks, "postAuthenticationChecks cannot be null");
this.postAuthenticationChecks = postAuthenticationChecks;
}
Since the field is initialized to a default checker, the assertion always passes, so null is silently accepted and the next authenticate(...) call fails with a raw NullPointerException at .doOnNext(this.postAuthenticationChecks::check) instead of failing fast with a clear message.
All other setters in the same class (setPasswordEncoder, setScheduler, setUserDetailsPasswordService, setMessageSource) validate the parameter.
To Reproduce
UserDetailsRepositoryReactiveAuthenticationManager manager =
new UserDetailsRepositoryReactiveAuthenticationManager(userDetailsService);
manager.setPostAuthenticationChecks(null); // no exception
manager.authenticate(token).block(); // NullPointerException
Expected behavior
setPostAuthenticationChecks(null) should throw IllegalArgumentException("postAuthenticationChecks cannot be null").
Describe the bug
The null check in
AbstractUserDetailsReactiveAuthenticationManager#setPostAuthenticationChecksasserts the current field value instead of the parameter:Since the field is initialized to a default checker, the assertion always passes, so
nullis silently accepted and the nextauthenticate(...)call fails with a rawNullPointerExceptionat.doOnNext(this.postAuthenticationChecks::check)instead of failing fast with a clear message.All other setters in the same class (
setPasswordEncoder,setScheduler,setUserDetailsPasswordService,setMessageSource) validate the parameter.To Reproduce
Expected behavior
setPostAuthenticationChecks(null)should throwIllegalArgumentException("postAuthenticationChecks cannot be null").