Issue 1:
Christophe Roudet opened SPR-7686 and commented

When using SpringBeanAutowiringSupport.processInjectionBasedOnServletContext()

a NullPointerException is raised in

InjectionMetadata.checkPropertySkipping(PropertyValues pvs)

protected boolean checkPropertySkipping(PropertyValues pvs) {
if (this.skip == null) {
synchronized (pvs) { // <-- NullPointerException
if (this.skip == null) {

in AutowiredAnnotationBeanPostProcessor.processInjection(Object bean)

metadata inject is called with null for PropertyValues

public void processInjection(Object bean) throws BeansException {
Class<?> clazz = bean.getClass();
InjectionMetadata metadata = findAutowiringMetadata(clazz);
try {
metadata.inject(bean, null, null); // <-- pvs is null
}
catch (Throwable ex) {
throw new BeanCreationException("Injection of autowired dependencies failed for class [" + clazz + "]", ex);
}
}

Here is the stack trace:

java.lang.NullPointerException
at org.springframework.beans.factory.annotation.InjectionMetadata$InjectedElement.checkPropertySkipping(InjectionMetadata.java:171)
at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredMethodElement.inject(AutowiredAnnotationBeanPostProcessor.java:526)
at org.springframework.beans.factory.annotation.InjectionMetadata.inject(InjectionMetadata.java:84)
at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.processInjection(AutowiredAnnotationBeanPostProcessor.java:300)
at org.springframework.web.context.support.SpringBeanAutowiringSupport.processInjectionBasedOnServletContext(SpringBeanAutowiringSupport.java:110)

Affects: 3.0.5

Issue Links:

#12344 NullPointerException could be thrown on synchronized (pvs) in InjectionMetadata.checkPropertySkipping ("is duplicated by")

#12291 Unresolved thread safety issue in AutowiredAnnotationBeanPostProcessor.AutowiredMethodElement

Referenced from: commits 9c64ac7

1 votes, 4 watchers

Issue 2:
Christian Nelson opened SPR-1899 and commented

I would like to see an analog to the DataBinder.setAllowedField(String[]) called setIgnoredFields(String[]) or setDisallowedFields(String[]).

In most scenarios, there are fewer fields to ignore than to allow. Almost all of my command objects have only one field that isn't allowed (id), though some of them might have a second if there's an id-based weak reference to another object. In any case, it seems to me that it's more developer friendly to support setting which properties should not be allowed.

There is some discussion around this issue on the forums ( http://forum.springframework.org/showthread.php?t=10820 ). Darren's point about "false sense of security" is valid, but the default behavior already gives a flase sense of security because everything is bound. I think it's important to make developers' jobs easy, and let them take responsility for their own code (instead of assuming users don't know what they're doing). By adding this setIgnored/Disallowed feature, each developer could decide when to use each version.

The only complication is if the user calls setAllowedFields(new String[] { "name", "address", "age" }) and setIgnoredFields(new String[] { "id", "name" }), which is clearly a mistake. Perhaps only one approach can be used for a particular form instance?

It wouldn't be difficult to create a new subclass of ServletRequestDataBinder to support this, but it's difficult to plug in the new binder because BaseCommandController.createBinder(HttpServletRequest request, Object command) does more than just create an instance, it also sets a number of important settings on the ServletRequestDataBinder.

I recommend either adding native support for ignored fields to DataBinder or one of it's subclasses, or make it easier to plug in a new subclass of ServletRequestDataBinder by seperating the creation of the ServletRequestDataBinder and the initialization that takes place in the current createBinder method.

Thanks,

Christian

Affects: 1.2.7, 2.0 M3

Attachments:

SpecialServletRequestDataBinder.java (988 bytes)

SpecialServletRequestDataBinderTest.java (1.46 kB)