shollander opened SPR-17629 and commented

Calling org.springframework.core.MethodParameter.isOptional() can fail with an ArrayIndexOutOfBoundsException. I have a custom ResponseBodyAdvice class that calls this method in supports(). It fails when it hits org.springframework.boot.actuate.endpoint.web.servelt.WebMvcEndpointHandlerMappings$WebMvcLinksHandler.links with the following exception:

java.lang.ArrayIndexOutOfBoundsException: -1
    at org.springframework.web.method.HandlerMethod$HandlerMethodParamater.getParameterAnnotations(HandlerMethod.java:484) ~[spring-web-5.1.3.RELEASE.jar:5.1.3.RELEASE]
    at org.springframework.core.MethodParameter.hasNullableAnnotation(MethodParameter.java:357) ~[spring-core-5.1.3.RELEASE.jar:5.1.3.RELEASE]
    at org.springframework.core.MethodParameter.isOptional(MethodParameter.java:345) ~[spring-core-5.1.3.RELEASE.jar:5.1.3.RELEASE]
    at com.example.advice.OptionalResponseBodyAdvice.supports(OptionalResponseBodyAdvice.java:18) ~[main/:na]
    at org.springframework.web.servlet.mvc.method.annotation.RequestBodyAdviceChain.processBody(RequestBodyAdviceChain.java:140) ~[spring-webmvc-5.1.3.RELEASE.jar:5.1.3.RELEASE]

Affects: 5.1.3

Issue Links: - #15682 Enable REST controller method parameter annotations on an interface

Referenced from: commits https://github.com/spring-projects/spring-framework/commit/1faeeaea14f8961a49d280da528fa4623fe7cfee

Comment From: shollander

@jhoeller This issue has not been fixed in 5.1.4. I still get the same ArrayIndexOutOfBoundsException, this time at line 486:

java.lang.ArrayIndexOutOfBoundsException: -1
    at org.springframework.web.method.HandlerMethod$HandlerMethodParamater.getParameterAnnotations(HandlerMethod.java:486) ~[spring-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
    at org.springframework.core.MethodParameter.hasNullableAnnotation(MethodParameter.java:357) ~[spring-core-5.1.4.RELEASE.jar:5.1.4.RELEASE]
    at org.springframework.core.MethodParameter.isOptional(MethodParameter.java:345) ~[spring-core-5.1.4.RELEASE.jar:5.1.4.RELEASE]
    at com.example.advice.OptionalResponseBodyAdvice.supports(OptionalResponseBodyAdvice.java:19) ~[main/:na]
    at org.springframework.web.servlet.mvc.method.annotation.RequestBodyAdviceChain.processBody(RequestBodyAdviceChain.java:140) ~[spring-webmvc-5.1.4.RELEASE.jar:5.1.4.RELEASE]

The problem is that the getParameterIndex() method called at https://github.com/spring-projects/spring-framework/blob/1faeeaea14f8961a49d280da528fa4623fe7cfee/spring-web/src/main/java/org/springframework/web/method/HandlerMethod.java#L484 will return -1 (as documented in its JavaDoc) in the case of a return type. The change in 1faeeae only addresses checking the upper bounds of index but not the lower bounds.

Comment From: rstoyanchev

I've edited your comment to improve the formatting. You might want to check out this Mastering Markdown guide for future reference.

Comment From: shollander

@rstoyanchev Thank you.

Comment From: jhoeller

I've created #22303 as a follow-up for 5.1.5, leaving this one as the ticket for the 5.1.4 release.

Comment From: Moonergfp

The 5.1.5 release notes don't contain the update, do they? i don't find it out. https://github.com/spring-projects/spring-framework/releases?page=9

Comment From: bclozel

@Moonergfp I'm seeing it listed under the bugs section on the release page: https://github.com/spring-projects/spring-framework/releases/tag/v5.1.5.RELEASE

Comment From: Moonergfp

I see, but what is the difference between these two release notes? And why does the description in https://github.com/spring-projects/spring-framework/releases?page=9 have fewer details than https://github.com/spring-projects/spring-framework/releases/tag/v5.1.5.RELEASE? @bclozel

Comment From: bclozel

@Moonergfp The first link is a link to a page, a collection of releases. The second link is a link to a single release.

Comment From: Moonergfp

@bclozel But the description content in the first link, regarding v5.1.5.RELEASE, is less detailed than the second

Comment From: bclozel

I don't see a v5.1.5.RELEASE release on that page.