You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Hello,
Our static analyzer found a following potential NPE. We have checked the feasibility of this execution trace. It is necessary to defend this vulnerability to improve the code quality. We have provided the patch for you. Please check and confirm it.
Here is the bug trace.
Select the false branch at this point (expressionClass==null is true), and null assigned to instance
The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
_ trunk Compile Tests _
+1 💚
mvninstall
30m 56s
trunk passed
+1 💚
compile
23m 55s
trunk passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚
compile
18m 34s
trunk passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
+1 💚
checkstyle
1m 8s
trunk passed
+1 💚
mvnsite
1m 36s
trunk passed
+1 💚
javadoc
1m 8s
trunk passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚
javadoc
1m 41s
trunk passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
+1 💚
spotbugs
2m 25s
trunk passed
+1 💚
shadedclient
15m 40s
branch has no errors when building and testing our client artifacts.
_ Patch Compile Tests _
+1 💚
mvninstall
0m 54s
the patch passed
+1 💚
compile
21m 12s
the patch passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚
javac
21m 12s
the patch passed
+1 💚
compile
19m 2s
the patch passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
+1 💚
javac
19m 2s
the patch passed
+1 💚
blanks
0m 0s
The patch has no blanks issues.
+1 💚
checkstyle
1m 3s
the patch passed
+1 💚
mvnsite
1m 33s
the patch passed
+1 💚
javadoc
1m 1s
the patch passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚
javadoc
1m 38s
the patch passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
hadoop-common-project/hadoop-common generated 1 new + 0 unchanged - 0 fixed = 1 total (was 0)
+1 💚
shadedclient
16m 2s
patch has no errors when building and testing our client artifacts.
_ Other Tests _
+1 💚
unit
17m 10s
hadoop-common in the patch passed.
+1 💚
asflicense
0m 49s
The patch does not generate ASF License warnings.
181m 14s
Reason
Tests
SpotBugs
module:hadoop-common-project/hadoop-common
Nullcheck of expr at line 114 of value previously dereferenced in org.apache.hadoop.fs.shell.find.Find.buildDescription(ExpressionFactory) At Find.java:114 of value previously dereferenced in org.apache.hadoop.fs.shell.find.Find.buildDescription(ExpressionFactory) At Find.java:[line 114]
The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
_ trunk Compile Tests _
+0 🆗
mvndep
12m 54s
Maven dependency ordering for branch
+1 💚
mvninstall
20m 8s
trunk passed
+1 💚
compile
21m 16s
trunk passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚
compile
18m 20s
trunk passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
+1 💚
checkstyle
3m 53s
trunk passed
+1 💚
mvnsite
2m 27s
trunk passed
+1 💚
javadoc
1m 56s
trunk passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚
javadoc
2m 23s
trunk passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
+1 💚
spotbugs
3m 28s
trunk passed
+1 💚
shadedclient
14m 15s
branch has no errors when building and testing our client artifacts.
_ Patch Compile Tests _
+0 🆗
mvndep
0m 28s
Maven dependency ordering for patch
+1 💚
mvninstall
1m 18s
the patch passed
+1 💚
compile
20m 26s
the patch passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚
javac
20m 26s
the patch passed
+1 💚
compile
18m 18s
the patch passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
+1 💚
javac
18m 18s
the patch passed
+1 💚
blanks
0m 0s
The patch has no blanks issues.
+1 💚
checkstyle
3m 40s
the patch passed
+1 💚
mvnsite
2m 25s
the patch passed
+1 💚
javadoc
1m 54s
the patch passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚
javadoc
2m 27s
the patch passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
hadoop-common-project/hadoop-common generated 1 new + 0 unchanged - 0 fixed = 1 total (was 0)
+1 💚
shadedclient
14m 38s
patch has no errors when building and testing our client artifacts.
_ Other Tests _
+1 💚
unit
17m 2s
hadoop-common in the patch passed.
+1 💚
unit
1m 2s
hadoop-mapreduce-examples in the patch passed.
+1 💚
asflicense
0m 59s
The patch does not generate ASF License warnings.
194m 12s
Reason
Tests
SpotBugs
module:hadoop-common-project/hadoop-common
Nullcheck of expr at line 114 of value previously dereferenced in org.apache.hadoop.fs.shell.find.Find.buildDescription(ExpressionFactory) At Find.java:114 of value previously dereferenced in org.apache.hadoop.fs.shell.find.Find.buildDescription(ExpressionFactory) At Find.java:[line 114]
The return value of function iterator is passed as the this pointer to function hasNext (the return value of function iterator can be null), which will leak to null pointer dereference
The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
_ trunk Compile Tests _
+0 🆗
mvndep
13m 42s
Maven dependency ordering for branch
+1 💚
mvninstall
20m 31s
trunk passed
+1 💚
compile
21m 23s
trunk passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚
compile
18m 26s
trunk passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
+1 💚
checkstyle
3m 40s
trunk passed
+1 💚
mvnsite
3m 11s
trunk passed
+1 💚
javadoc
2m 20s
trunk passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚
javadoc
2m 57s
trunk passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
+1 💚
spotbugs
4m 42s
trunk passed
+1 💚
shadedclient
14m 27s
branch has no errors when building and testing our client artifacts.
_ Patch Compile Tests _
+0 🆗
mvndep
0m 26s
Maven dependency ordering for patch
+1 💚
mvninstall
1m 54s
the patch passed
+1 💚
compile
20m 41s
the patch passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚
javac
20m 41s
the patch passed
+1 💚
compile
18m 33s
the patch passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
hadoop-common-project/hadoop-common generated 1 new + 0 unchanged - 0 fixed = 1 total (was 0)
+1 💚
shadedclient
14m 36s
patch has no errors when building and testing our client artifacts.
_ Other Tests _
+1 💚
unit
16m 56s
hadoop-common in the patch passed.
+1 💚
unit
0m 57s
hadoop-mapreduce-examples in the patch passed.
+1 💚
unit
2m 18s
hadoop-aws in the patch passed.
+1 💚
asflicense
0m 54s
The patch does not generate ASF License warnings.
215m 32s
Reason
Tests
SpotBugs
module:hadoop-common-project/hadoop-common
Nullcheck of expr at line 114 of value previously dereferenced in org.apache.hadoop.fs.shell.find.Find.buildDescription(ExpressionFactory) At Find.java:114 of value previously dereferenced in org.apache.hadoop.fs.shell.find.Find.buildDescription(ExpressionFactory) At Find.java:[line 114]
The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
_ trunk Compile Tests _
+0 🆗
mvndep
13m 1s
Maven dependency ordering for branch
+1 💚
mvninstall
21m 52s
trunk passed
+1 💚
compile
22m 17s
trunk passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚
compile
19m 27s
trunk passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
+1 💚
checkstyle
3m 58s
trunk passed
+1 💚
mvnsite
3m 9s
trunk passed
+1 💚
javadoc
2m 25s
trunk passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚
javadoc
3m 7s
trunk passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
+1 💚
spotbugs
4m 53s
trunk passed
+1 💚
shadedclient
20m 26s
branch has no errors when building and testing our client artifacts.
_ Patch Compile Tests _
+0 🆗
mvndep
0m 30s
Maven dependency ordering for patch
+1 💚
mvninstall
2m 5s
the patch passed
+1 💚
compile
22m 0s
the patch passed with JDK Ubuntu-11.0.11+9-Ubuntu-0ubuntu2.20.04
+1 💚
javac
22m 0s
the patch passed
+1 💚
compile
19m 12s
the patch passed with JDK Private Build-1.8.0_292-8u292-b10-0ubuntu1~20.04-b10
hadoop-common-project/hadoop-common generated 1 new + 0 unchanged - 0 fixed = 1 total (was 0)
+1 💚
shadedclient
20m 39s
patch has no errors when building and testing our client artifacts.
_ Other Tests _
+1 💚
unit
17m 18s
hadoop-common in the patch passed.
+1 💚
unit
1m 1s
hadoop-mapreduce-examples in the patch passed.
+1 💚
unit
2m 28s
hadoop-aws in the patch passed.
+1 💚
asflicense
1m 2s
The patch does not generate ASF License warnings.
223m 35s
Reason
Tests
SpotBugs
module:hadoop-common-project/hadoop-common
Nullcheck of expr at line 114 of value previously dereferenced in org.apache.hadoop.fs.shell.find.Find.buildDescription(ExpressionFactory) At Find.java:114 of value previously dereferenced in org.apache.hadoop.fs.shell.find.Find.buildDescription(ExpressionFactory) At Find.java:[line 114]
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hello,
Our static analyzer found a following potential NPE. We have checked the feasibility of this execution trace. It is necessary to defend this vulnerability to improve the code quality. We have provided the patch for you. Please check and confirm it.
Here is the bug trace.
Select the false branch at this point (expressionClass==null is true), and null assigned to instance
hadoop/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/shell/find/ExpressionFactory.java
Lines 129 to 133 in 986d0a4
Return instance to caller, which can be null (The return value can be null)
hadoop/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/shell/find/ExpressionFactory.java
Line 133 in 986d0a4
Function createExpression executes and stores the return value to expr (expr can be null)
hadoop/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/shell/find/Find.java
Line 113 in 986d0a4
Function add executes and primaries contains null value
hadoop/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/shell/find/Find.java
Line 117 in 986d0a4
Function next executes and stores the return value to expr (expr can be null)
hadoop/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/shell/find/Find.java
Line 139 in 986d0a4
expr is passed as the this pointer to function getUsage (expr can be null), which will leak to null pointer dereference
hadoop/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/shell/find/Find.java
Line 140 in 986d0a4
Commit: 986d0a4
ContainerAnalyzer