Hello, Our static analyzer found a following potential NPE. We have checked the feasibility of this execution trace. It is necessary to defend this vulnerability to improve the code quality.

  1. Return null to caller https://github.com/spring-projects/spring-boot/blob/e5ee1eb86f0db33bcd18462fe72809afb33274bc/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/logging/logback/LogbackLoggingSystem.java#L261

  2. Function getLoggerConfiguration executes and stores the return value to loggerconfiguration (loggerconfiguration can be null) https://github.com/spring-projects/spring-boot/blob/e5ee1eb86f0db33bcd18462fe72809afb33274bc/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/logging/logback/LogbackLoggingSystem.java#L239

  3. Function add executes and result contains null value. https://github.com/spring-projects/spring-boot/blob/e5ee1eb86f0db33bcd18462fe72809afb33274bc/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/logging/logback/LogbackLoggingSystem.java#L239

  4. Program reaches the return point, and return result https://github.com/spring-projects/spring-boot/blob/e5ee1eb86f0db33bcd18462fe72809afb33274bc/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/logging/logback/LogbackLoggingSystem.java#L242

  5. Function getLoggerConfigurations assign the returned value to configurations, which contains null value https://github.com/spring-projects/spring-boot/blob/e5ee1eb86f0db33bcd18462fe72809afb33274bc/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/logging/logback/LogbackLoggingSystemTests.java#L218

  6. Function get executes and can return null https://github.com/spring-projects/spring-boot/blob/e5ee1eb86f0db33bcd18462fe72809afb33274bc/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/logging/logback/LogbackLoggingSystemTests.java#L220

  7. The return value of function get is passed as the this pointer to function getName (the return value of function get can be null), which will leak to null pointer dereference https://github.com/spring-projects/spring-boot/blob/e5ee1eb86f0db33bcd18462fe72809afb33274bc/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/logging/logback/LogbackLoggingSystemTests.java#L220

Commit: e5ee1eb86f0db33bcd18462fe72809afb33274bc

ContainerAnalyzer

Comment From: wilkinsona

Thanks for the analysis but this code will never result in a NullPointerException as there will always be a root logger.