NullPointerException when unmarshaling JSON, when quarkus-elytron-security-properties-file is used

[andersnor]

When adding the dependency quarkus-elytron-security-properties-file, and setting up security in application.properties, calling a REST endpoint with a JSON body fails to map JSON to a POJO

org.jboss.resteasy.spi.UnhandledException: java.lang.NullPointerException
        at org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:106)
        at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:372)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:209)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:496)
        at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:252)
        at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:153)
        at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:363)
        at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:156)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:238)
        at io.quarkus.resteasy.runtime.standalone.RequestDispatcher.service(RequestDispatcher.java:69)
        at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.dispatch(VertxRequestHandler.java:104)
        at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.dispatchRequestContext(VertxRequestHandler.java:83)
        at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.lambda$handle$0(VertxRequestHandler.java:70)
        at io.vertx.core.impl.ContextImpl.lambda$executeBlocking$2(ContextImpl.java:316)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
        at java.base/java.lang.Thread.run(Thread.java:834)
Caused by: java.lang.NullPointerException
        at org.acme.rest.json.FruitResource.hello(FruitResource.java:14)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:151)
        at org.jboss.resteasy.core.MethodInjectorImpl.lambda$invoke$3(MethodInjectorImpl.java:122)
        at java.base/java.util.concurrent.CompletableFuture.uniApplyNow(CompletableFuture.java:680)
        at java.base/java.util.concurrent.CompletableFuture.uniApplyStage(CompletableFuture.java:658)
        at java.base/java.util.concurrent.CompletableFuture.thenApply(CompletableFuture.java:2094)
        at java.base/java.util.concurrent.CompletableFuture.thenApply(CompletableFuture.java:143)
        at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:122)
        at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:594)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:468)
        at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$2(ResourceMethodInvoker.java:421)
        at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:363)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:423)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:391)
        at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invoke$1(ResourceMethodInvoker.java:365)
        at java.base/java.util.concurrent.CompletableFuture.uniComposeStage(CompletableFuture.java:1106)
        at java.base/java.util.concurrent.CompletableFuture.thenCompose(CompletableFuture.java:2235)
        at java.base/java.util.concurrent.CompletableFuture.thenCompose(CompletableFuture.java:143)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:365)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:477)
        ... 14 more

Steps to reproduce:

Clone latest rest-json

mvn io.quarkus:quarkus-maven-plugin:0.25.0:create \
    -DprojectGroupId=org.acme \
    -DprojectArtifactId=rest-json \
    -DclassName="org.acme.rest.json.FruitResource" \
    -Dpath="/fruits" \
    -Dextensions="resteasy-jackson"

Add to POM

<dependency>
  <groupId>io.quarkus</groupId>
  <artifactId>quarkus-elytron-security-properties-file</artifactId>
</dependency>

Add to application.properties

quarkus.security.users.file.enabled=true
quarkus.security.users.file.users=users.properties
quarkus.security.users.file.roles=roles.properties
quarkus.security.users.file.realm-name=SN
quarkus.security.users.file.plain-text=true

Add files:
roles.properties
auser=User

users.properties
auser=password

Add a simple POJO like:
Test.java

package org.acme.rest.json;

import java.util.Objects;

public class Test {
    private String one;
    private Integer two;

    public Test() {
    }

    public Test(String one, Integer two) {
        this.one = one;
        this.two = two;
    }

    public String getOne() {
        return one;
    }

    public void setOne(String one) {
        this.one = one;
    }

    public Integer getTwo() {
        return two;
    }

    public void setTwo(Integer two) {
        this.two = two;
    }

    @Override
    public boolean equals(Object o) {
        if (this == o) return true;
        if (o == null || getClass() != o.getClass()) return false;
        Test test = (Test) o;
        return Objects.equals(one, test.one) &&
                Objects.equals(two, test.two);
    }

    @Override
    public int hashCode() {
        return Objects.hash(one, two);
    }

    @Override
    public String toString() {
        return "Test{" +
                "one='" + one + '\'' +
                ", two=" + two +
                '}';
    }
}

Change FruitResource to POST, and use POJO as input parameter:

@POST
    @Produces(MediaType.TEXT_PLAIN)
    public String hello(Test t) {
        return t.toString();
    }

[gsmet]

Thanks for the report. Do you have a curl command line (or any other command line) to reproduce the issue?

[andersnor]

curl -X POST \
  http://localhost:8080/fruits \
  -H 'Accept: */*' \
  -H 'Accept-Encoding: gzip, deflate' \
  -H 'Authorization: Basic YXVzZXI6cGFzc3dvcmQ=' \
  -H 'Cache-Control: no-cache' \
  -H 'Connection: keep-alive' \
  -H 'Content-Length: 28' \
  -H 'Content-Type: application/json' \
  -H 'Cookie: LtpaToken2=HGmx9qV2eK3FnhyCJmBVi8YkpQ/4KKq6MMZSDKocCd5EPUTvAmBlWCvETaA7wcHUfNs/zhi1mTj7T22iXTYkS0eJAV7NswWCBSgNq37/yLgp+hJXq61K4D4Cul0gKD2ewecVUnyUAj1SoYv3hi4jwPvK1r+H5DkB3GMwqL0ff8k5TxqYPW2TX2HGfadTYhSS914xDxpRdEBhODJzinbSMRKDk+o9hbZKfHdcZhldA55XhhlCV11/bC5cBWKpdKldo4LlIQUxrsfjqjBql0z4VbpJFK9521l2qcB12TiIQmPDrkMP1YnRJR0lyUQiLTlvVOmdzPkWA8ext4+58eqOPhnDzLjB9uaNIhmVVP5yT8lYRJKH/YoOYtebYZEP5j0ByDpH6CNlFOGBrHpeyHa/lHDhQmf6sgTRQKRMWn/C7ImkseZavVygMNtGSis8nWPW' \
  -H 'Host: localhost:8080' \
  -H 'Postman-Token: e6370e88-65d7-4b18-80b8-13470bab8b6d,12a479e9-0281-4291-86f1-4a65eb87ac27' \
  -H 'User-Agent: PostmanRuntime/7.18.0' \
  -H 'cache-control: no-cache' \
  -d '{
	"one": "One",
	"two": 2
}'

[geoand]

I can take a look at this tomorrow if no one else beats me to it.

[geoand]

I can reproduce the problem both in Quarkus 0.25 and the latest master. I'll look into it.

[geoand]

@stuartwdouglas I think you'll probably have to look at this one.
I was able to track this down to AuthenticationRequestContext#runBlocking being problematic (see details of what I did to arrive to this conclusion at the end).

It seems like when AuthenticationRequestContext#runBlocking is used, the io.vertx.core.http.impl.HttpServerRequestImpl is read and closed thus causing RESTEasy to not read any data from the request body when it has it's turn to run.

---

Details pointing to AuthenticationRequestContext#runBlocking as the culprit

Initially I wanted to take all dynamicity out of ElytronPasswordIdentityProvider. So I changed the method body of authenticate to be:

                return context.runBlocking(new Supplier<SecurityIdentity>() {
                    @Override
                    public SecurityIdentity get() {
                        QuarkusSecurityIdentity.Builder builder = QuarkusSecurityIdentity.builder();
                        builder.setPrincipal(new Principal() {
                            @Override
                            public String getName() {
                                return "user";
                            }
                        });
                        builder.addRole("User");
                        builder.addCredential(new Credential() {
                            @Override
                            public String toString() {
                                return "password";
                            }
                        });
                        return builder.build();
                    }
                });

With this change the problem is still present (although it manifests less frequently).

Now if I change the method body to:

        QuarkusSecurityIdentity.Builder builder = QuarkusSecurityIdentity.builder();
        builder.setPrincipal(new Principal() {
            @Override
            public String getName() {
                return "user";
            }
        });
        builder.addRole("User");
        builder.addCredential(new Credential() {
            @Override
            public String toString() {
                return "password";
            }
        });

        CompletableFuture<SecurityIdentity> cf = new CompletableFuture<>();
        cf.complete(builder.build());

        return cf;

the problem goes away completely.