NPE during aggregate check in a multi module project #3679

ST-DDT · 2021-09-29T18:11:28Z

Describe the bug

NPE during aggregate check in a multi module project

Version of dependency-check used

Maven-Plugin:

6.3.2 has the error
6.3.1 doesn't have the error

Log file

Stacktrace (Click to expand)

[ERROR] Failed to execute goal org.owasp:dependency-check-maven:6.3.2:aggregate (aggregate) on project gui-base: Execution aggregate of goal org.owasp:dependency-check-maven:6.3.2:aggregate failed.: NullPointerException -> [Help 1]
org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal org.owasp:dependency-check-maven:6.3.2:aggregate (aggregate) on project gui-base: Execution aggregate of goal org.owasp:dependency-check-maven:6.3.2:aggregate failed.
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:215)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
    at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192)
    at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
    at org.apache.maven.cli.MavenCli.execute (MavenCli.java:957)
    at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:289)
    at org.apache.maven.cli.MavenCli.main (MavenCli.java:193)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
    at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:566)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:282)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:225)
    at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:406)
    at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:347)
Caused by: org.apache.maven.plugin.PluginExecutionException: Execution aggregate of goal org.owasp:dependency-check-maven:6.3.2:aggregate failed.
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:148)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:210)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
    at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192)
    at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
    at org.apache.maven.cli.MavenCli.execute (MavenCli.java:957)
    at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:289)
    at org.apache.maven.cli.MavenCli.main (MavenCli.java:193)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
    at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:566)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:282)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:225)
    at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:406)
    at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:347)
Caused by: java.lang.NullPointerException
    at org.apache.maven.shared.artifact.filter.resolve.transform.EclipseAetherFilterTransformer$2.accept (EclipseAetherFilterTransformer.java:152)
    at org.eclipse.aether.util.filter.AndDependencyFilter.accept (AndDependencyFilter.java:83)
    at org.eclipse.aether.util.filter.OrDependencyFilter.accept (OrDependencyFilter.java:81)
    at org.eclipse.aether.util.graph.visitor.FilteringDependencyVisitor.visitEnter (FilteringDependencyVisitor.java:80)
    at org.eclipse.aether.util.graph.visitor.TreeDependencyVisitor.visitEnter (TreeDependencyVisitor.java:67)
    at org.eclipse.aether.graph.DefaultDependencyNode.accept (DefaultDependencyNode.java:343)
    at org.eclipse.aether.internal.impl.DefaultRepositorySystem.resolveDependencies (DefaultRepositorySystem.java:332)
    at org.apache.maven.shared.transfer.dependencies.resolve.internal.Maven31DependencyResolver.resolveDependencies (Maven31DependencyResolver.java:216)
    at org.apache.maven.shared.transfer.dependencies.resolve.internal.Maven31DependencyResolver.resolveDependencies (Maven31DependencyResolver.java:198)
    at org.apache.maven.shared.transfer.dependencies.resolve.internal.DefaultDependencyResolver.resolveDependencies (DefaultDependencyResolver.java:60)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.collectMavenDependencies (BaseDependencyCheckMojo.java:1328)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.collectDependencies (BaseDependencyCheckMojo.java:1467)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.scanArtifacts (BaseDependencyCheckMojo.java:1114)
    at org.owasp.dependencycheck.maven.AggregateMojo.scanDependencies (AggregateMojo.java:73)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:1719)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:966)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:210)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
    at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192)
    at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
    at org.apache.maven.cli.MavenCli.execute (MavenCli.java:957)
    at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:289)
    at org.apache.maven.cli.MavenCli.main (MavenCli.java:193)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
    at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:566)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:282)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:225)
    at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:406)
    at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:347)
[ERROR]
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/PluginExecutionException

To Reproduce

Run the aggregate goal in a multi module project.

Expected behavior

No exception

Additional context
Add any other context about the problem here.

vveider · 2021-09-30T09:01:57Z

Confirm NPE in aggregate, downgraded to 6.3.1 version

OrangeDog · 2021-09-30T09:53:39Z

Nothing to do with aggregates or multi-module. I get the same NPE stacktrace running check on a single regular project.

mkemmerz · 2021-10-01T05:55:10Z

I can confirm this issue as well. We also get the NPE in the 6.3.2.

KaVeKa · 2021-10-01T06:51:21Z

Can confirm this too. When upgrading from 6.3.1 to 6.3.2, this NPE occurs.

viktor-thell-seal · 2021-10-01T10:48:36Z

Same problem here, guessing it is caused by changes introduced by #3627

jeremylong · 2021-10-01T12:18:05Z

Can anyone provide a sample pom.xml and version of maven that is having this issue?

acanda · 2021-10-02T13:39:04Z

I ran into the same issue. The branch bug/dependency-check-maven-6.3.2-npe of the repository acanda/spring-banner-plugin contains a small Maven project that reproduces the issue when you run mvn clean verify -X. The NPE does not occur with 6.3.1.

The NPE occurs with both Maven 3.6.3 and 3.8.2:

> mvn -version
Apache Maven 3.6.3 (cecedd343002696d0abb50b32b541b8a6ba2883f)
Maven home: /c/Program Files/Maven/maven-3.6.3
Java version: 11.0.6, vendor: AdoptOpenJDK, runtime: /usr/lib/jvm/adoptopenjdk-11-hotspot-amd64
Default locale: en_US, platform encoding: UTF-8
OS name: "linux", version: "4.4.0-19041-microsoft", arch: "amd64", family: "unix"

> mvn -version
Apache Maven 3.8.2 (ea98e05a04480131370aa0c110b8c54cf726c06f)
Maven home: /c/Program Files/Maven/maven-3.8.2
Java version: 11.0.6, vendor: AdoptOpenJDK, runtime: /usr/lib/jvm/adoptopenjdk-11-hotspot-amd64
Default locale: en_US, platform encoding: UTF-8
OS name: "linux", version: "4.4.0-19041-microsoft", arch: "amd64", family: "unix"

aikebah · 2021-10-05T16:10:47Z

@jeremylong I'll have a look at this

aikebah · 2021-10-05T17:06:28Z

Appears to have its root-cause triggered by dependencies with classifiers. The culprit in spring-banner-plugin is for com.google.inject:guice:jar:no_aop:4.2.2, all other dependencies of the project have group:artifact:extension:version and succeed without NPE.

aikebah · 2021-10-05T17:38:02Z

It breaks at the project-level dependency-node which is represented by a null-artifact DependencyNode with children, not sure whether Maven project would expect the project node to be offered to the resolver. It appears to at least not have been tested like with a filter for a classifier as the NPE is deep down in the maven shared utilities.

aikebah · 2021-10-05T18:48:31Z

Fairly certain this is a bug in the maven shared utilities that's biting us with the transition to the maven DependencyResolver in order to properly process maven repositories in the dependency-tree.

aikebah · 2021-10-05T20:05:56Z

Registered https://issues.apache.org/jira/browse/MSHARED-998

carlmolemans · 2021-10-06T06:50:36Z

Can we revert this until the fix in maven shared components is available?
Apart from that, this is introduces a breaking change and in my opinion should not just bump the patch version of this plugin.

aikebah · 2021-10-06T08:24:54Z

It's only a breaking change because the maven resolution is breaking. The change itself is a bugfix for a regression bug in 6.3: #3626. Unfortunately apparently none of our test-cases included a (direct or transitive) dependency with a classifier which made this bug surface only in the wild.

viktor-thell-seal · 2021-10-06T09:00:39Z

@aikebah Great work digging in to this. Do you have any experience with how long time getting bugs fixed in Maven shared utilities might take? Also will you add a test for this to ensure dependencies with classifiers work in the future?

aikebah · 2021-10-06T09:12:38Z

@viktor-thell-seal Definitely want to include a test to ensure this doesn't surface again in future. Still looking to see if we can change our internal resolution approach to mitigate the issue without requiring a fix in the maven shared utilities.
No experience on my side regarding timelines for a fix in maven.

aikebah · 2021-10-06T16:04:11Z

Found a work-around that makes at least the sample project @acanda shared pass. Running some final validations to see if the new testcase properly breaks at this issue without the patch and when succeeding expect to file a PR later tonight for review by @jeremylong.

jeremylong · 2021-10-06T21:45:14Z

The fix will be released - hopefully Friday morning (US Eastern).

This reverts commit d7dbd80. Reason: jeremylong/DependencyCheck#3679

ghost · 2021-10-11T15:41:40Z

Could you leave this issue open untill it is solved? I ran into the same issue and could not find this ticket. Probably many others will experience the same.

alexvanmanen · 2021-10-11T15:42:28Z

released

Is it already solved? I ran in the same issue

jeremylong · 2021-10-11T16:35:09Z

The fix will be in the next release - just finishing up testing.

m2ger · 2021-10-12T03:47:09Z

Had the same NPE with 6.3.2; updated dependency-check-maven plugin version to 6.4.1 and can confirm this is no more an issue here.

            <plugin>
                <groupId>org.owasp</groupId>
                <artifactId>dependency-check-maven</artifactId>
                <version>6.4.1</version>
                <reportSets>
                    <reportSet>
                        <reports>
                            <report>aggregate</report>
                        </reports>
                    </reportSet>
                </reportSets>
            </plugin>

ghost · 2021-10-12T07:17:30Z

Can confirm that 6.4.1 works. Thank you

vveider · 2021-10-19T16:08:18Z

I too do confirm that 6.4.1 fixed the issue.

ST-DDT added the bug label Sep 29, 2021

croudet mentioned this issue Oct 1, 2021

Error when upgrading from v3.6.1 to v3.6.2 #3689

Closed

jeremylong added the pending more information label Oct 2, 2021

jeremylong mentioned this issue Oct 5, 2021

6.3.1 -> 6.3.2 NPE #3694

Closed

This was referenced Oct 6, 2021

Work-around for MSHARED-998 until it's resolved and we can upgrade to a newer transfer-utils #3702

Merged

NPE in EclipseAetherFilterTransformer$2.accept #3701

Closed

aikebah removed the pending more information label Oct 6, 2021

This was referenced Oct 6, 2021

Bump dependency-check-maven from 6.3.1 to 6.3.2 GeoDienstenCentrum/schemaspy-maven-plugin#267

Closed

Bump dependency-check-maven from 6.3.1 to 6.3.2 B3Partners/brmo#1178

Closed

jeremylong added this to the 6.4.0 milestone Oct 6, 2021

jeremylong closed this as completed Oct 6, 2021

jeremylong mentioned this issue Oct 6, 2021

getting Null Pointer Exception (NPE) with: mvn dependency-check:aggregate #3703

Closed

superkoni mentioned this issue Oct 7, 2021

null return value of "org.eclipse.aether.graph.DependencyNode.getArtifact()" #3706

Closed

hylkevds added a commit to FraunhoferIOSB/FROST-Server that referenced this issue Oct 11, 2021

Revert "Bump dependency-check-maven from 6.3.1 to 6.3.2 (#592)"

8e4db0f

This reverts commit d7dbd80. Reason: jeremylong/DependencyCheck#3679

viktor-thell-seal mentioned this issue Oct 12, 2021

Maven31DependencyResolverException for aggregate dependency check #3730

Closed

sammyhk mentioned this issue Dec 28, 2021

Huge performance degradation after upgrade dependency-check-maven from 6.3.1 to 6.4.x / 6.5.x #3923

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

NPE during aggregate check in a multi module project #3679

NPE during aggregate check in a multi module project #3679

ST-DDT commented Sep 29, 2021

vveider commented Sep 30, 2021

OrangeDog commented Sep 30, 2021 •

edited

Loading

mkemmerz commented Oct 1, 2021

KaVeKa commented Oct 1, 2021

viktor-thell-seal commented Oct 1, 2021

jeremylong commented Oct 1, 2021

acanda commented Oct 2, 2021 •

edited

Loading

aikebah commented Oct 5, 2021

aikebah commented Oct 5, 2021

aikebah commented Oct 5, 2021

aikebah commented Oct 5, 2021

aikebah commented Oct 5, 2021

carlmolemans commented Oct 6, 2021 •

edited

Loading

aikebah commented Oct 6, 2021

viktor-thell-seal commented Oct 6, 2021

aikebah commented Oct 6, 2021

aikebah commented Oct 6, 2021

jeremylong commented Oct 6, 2021

ghost commented Oct 11, 2021

alexvanmanen commented Oct 11, 2021 •

edited

Loading

jeremylong commented Oct 11, 2021

m2ger commented Oct 12, 2021

ghost commented Oct 12, 2021

vveider commented Oct 19, 2021

NPE during aggregate check in a multi module project #3679

NPE during aggregate check in a multi module project #3679

Comments

ST-DDT commented Sep 29, 2021

vveider commented Sep 30, 2021

OrangeDog commented Sep 30, 2021 • edited Loading

mkemmerz commented Oct 1, 2021

KaVeKa commented Oct 1, 2021

viktor-thell-seal commented Oct 1, 2021

jeremylong commented Oct 1, 2021

acanda commented Oct 2, 2021 • edited Loading

aikebah commented Oct 5, 2021

aikebah commented Oct 5, 2021

aikebah commented Oct 5, 2021

aikebah commented Oct 5, 2021

aikebah commented Oct 5, 2021

carlmolemans commented Oct 6, 2021 • edited Loading

aikebah commented Oct 6, 2021

viktor-thell-seal commented Oct 6, 2021

aikebah commented Oct 6, 2021

aikebah commented Oct 6, 2021

jeremylong commented Oct 6, 2021

ghost commented Oct 11, 2021

alexvanmanen commented Oct 11, 2021 • edited Loading

jeremylong commented Oct 11, 2021

m2ger commented Oct 12, 2021

ghost commented Oct 12, 2021

vveider commented Oct 19, 2021

OrangeDog commented Sep 30, 2021 •

edited

Loading

acanda commented Oct 2, 2021 •

edited

Loading

carlmolemans commented Oct 6, 2021 •

edited

Loading

alexvanmanen commented Oct 11, 2021 •

edited

Loading