search

cuba-platform / cuba

CUBA Platform is a high level framework for enterprise applications development
https://www.cuba-platform.com
Apache License 2.0
1.34k stars 219 forks source link

Check permission on null value while creating role objects in security system #3284

Closed andreysubbotin closed 2 years ago

andreysubbotin commented 2 years ago

Environment

Description of the bug or enhancement

When migrating from older versions of the platform (e.g 5.2), a situation is possible when permission is created with null value. As the result, exception may be occur:

java.lang.NullPointerException: null
    at com.haulmont.cuba.security.role.BasicRoleDefinition$BasicRoleDefinitionBuilder.withPermissions(BasicRoleDefinition.java:297) ~[cuba-global-7.2.19.jar:7.2.19]
    at com.haulmont.cuba.security.app.role.RolesHelper.transformToRoleDefinition(RolesHelper.java:204) ~[cuba-core-7.2.19.jar:7.2.19]
    at com.haulmont.cuba.security.app.role.RolesHelper.getRoleDefinitionsForUser(RolesHelper.java:149) ~[cuba-core-7.2.19.jar:7.2.19]
    at com.haulmont.cuba.security.sys.UserSessionManager.createSession(UserSessionManager.java:139) ~[cuba-core-7.2.19.jar:7.2.19]
    at com.haulmont.cuba.security.sys.UserSessionManager.createSession(UserSessionManager.java:110) ~[cuba-core-7.2.19.jar:7.2.19]

The error is a regression of 7.2 security subsystem changes. So security subsystem should ignore such type of permissions, how it was done in 7.1 or 5.2 platform versions.