Source:
<code>protected void service(HttpServletRequest servletRequest, HttpServletResponse servletResponse) throws ServletException, IOException { switch (securityMode) { case NONE: super.service(servletRequest, servletResponse); break; case DB_LINK_CHECK: boolean proxyCallAllowed = false; UserSession userSession = ApiUtils.getUserSession(servletRequest.getSession()); <START> if (userSession.isAuthenticated()) { <END> proxyCallAllowed = true; } if (proxyCallAllowed == false && securityMode == SECURITY_MODE.DB_LINK_CHECK) { try { URI uri = new URI(servletRequest.getParameter("url")); String host = uri.getHost(); LinkRepository linkRepository = ApplicationContextHolder.get().getBean(LinkRepository.class); long linksFound = linkRepository.count( LinkSpecs.filter(host, null, null, null, null, null)); if (linksFound == 0) { String message = String.format( "The proxy does not allow to access '%s' " + "because the URL host was not registered in any metadata records.", uri ); if (linkRepository.count() == 0) { throw new NotAllowedException( "The proxy is configured with DB_LINK_CHECK mode " + "but the MetadataLink table is empty. " + "Administrator may need to analyze record links from the admin console " + "in order to register URL allowed by the proxy. " + message); } throw new NotAllowedException(message); } proxyCallAllowed = linksFound > 0; } catch (URISyntaxException e) { throw new IllegalArgumentException(String.format( "'%s' is invalid. Error is: '%s'", e.getMessage() )); } } if(proxyCallAllowed) { super.service(servletRequest, servletResponse); } break; } }</code><technical_language>ApiUtils.getUserSession return null? In case this throw a NullPointerException. throw a SecurityException in case</technical_language>

Target:
protected void service(HttpServletRequest servletRequest, HttpServletResponse servletResponse) throws ServletException, IOException { switch (securityMode) { case NONE: super.service(servletRequest, servletResponse); break; case DB_LINK_CHECK: boolean proxyCallAllowed = false; try { UserSession userSession = ApiUtils.getUserSession(servletRequest.getSession()); if (userSession.isAuthenticated()) { proxyCallAllowed = true; } } catch (SecurityException securityException) { servletResponse.sendError(HttpServletResponse.SC_FORBIDDEN, securityException.getMessage()); } if (proxyCallAllowed == false && securityMode == SECURITY_MODE.DB_LINK_CHECK) { try { URI uri = new URI(servletRequest.getParameter("url")); String host = uri.getHost(); LinkRepository linkRepository = ApplicationContextHolder.get().getBean(LinkRepository.class); long linksFound = linkRepository.count( LinkSpecs.filter(host, null, null, null, null, null)); if (linksFound == 0) { String message = String.format( "The proxy does not allow to access '%s' " + "because the URL host was not registered in any metadata records.", uri ); if (linkRepository.count() == 0) { servletResponse.sendError(HttpServletResponse.SC_FORBIDDEN, "The proxy is configured with DB_LINK_CHECK mode " + "but the MetadataLink table is empty. " + "Administrator may need to analyze record links from the admin console " + "in order to register URL allowed by the proxy. " + message); } servletResponse.sendError(HttpServletResponse.SC_FORBIDDEN, message); } proxyCallAllowed = linksFound > 0; } catch (URISyntaxException e) { throw new IllegalArgumentException(String.format( "'%s' is invalid. Error is: '%s'", e.getMessage() )); } } if (proxyCallAllowed) { super.service(servletRequest, servletResponse); } break; } }