Skip to content

fix: add pre-check on expireTime in AccessTokenManager - #6981

Open
hengyuss wants to merge 1 commit into
apache:masterfrom
hengyuss:fix/AccessTokenManager_NPE_on_missing_expiredTime_kills_scheduled_token_refresh_permanently
Open

fix: add pre-check on expireTime in AccessTokenManager#6981
hengyuss wants to merge 1 commit into
apache:masterfrom
hengyuss:fix/AccessTokenManager_NPE_on_missing_expiredTime_kills_scheduled_token_refresh_permanently

Conversation

@hengyuss

Copy link
Copy Markdown
Contributor

Fixes: #6841

Make sure that:

  • You have read the contribution guidelines.
  • You submit test cases (unit or integration tests) that back your changes.
  • Your local test passed ./mvnw clean install -Dmaven.javadoc.skip=true.

@Aias00 Aias00 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This still leaves the scheduled refresh vulnerable to unchecked parsing failures. The new null check handles a missing expiredTime, but doLogin only catches IOException; for example a successful response with data: null makes tokenMap null before this check, and a response where expiredTime is encoded as a string passes the null check but throws at the (long) expiredTime cast. Since start() runs login() from scheduleWithFixedDelay, an uncaught runtime exception can still suppress future refresh attempts. Could you validate the login payload and return false for malformed responses, and/or guard the scheduled task so refresh continues after one bad response?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] AccessTokenManager NPE on missing expiredTime — kills scheduled token refresh permanently

2 participants