(nifi) branch main updated: NIFI-16454 Prevent NullPointerException for unnamed modules in AllowListClassLoader (#11810)

[exceptionfactory]

This is an automated email from the ASF dual-hosted git repository.

exceptionfactory pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/nifi.git


The following commit(s) were added to refs/heads/main by this push:
     new 91856b41375 NIFI-16454 Prevent NullPointerException for unnamed 
modules in AllowListClassLoader (#11810)
91856b41375 is described below

commit 91856b4137594f0f09a213c21da450d70d1bc4de
Author: divijaksolves <divija.g...@ksolves.com>
AuthorDate: Thu Oct 29 19:10:24 2026 +0530

    NIFI-16454 Prevent NullPointerException for unnamed modules in 
AllowListClassLoader (#11810)
    
    Signed-off-by: David Handermann <exceptionfact...@apache.org>
---
 .../stateless/bootstrap/AllowListClassLoader.java  |  5 +-
 .../bootstrap/TestAllowListClassLoader.java        | 67 ++++++++++++++++++++++
 2 files changed, 71 insertions(+), 1 deletion(-)

diff --git 
a/nifi-stateless/nifi-stateless-bootstrap/src/main/java/org/apache/nifi/stateless/bootstrap/AllowListClassLoader.java
 
b/nifi-stateless/nifi-stateless-bootstrap/src/main/java/org/apache/nifi/stateless/bootstrap/AllowListClassLoader.java
index 3a90031d701..311fdc3a117 100644
--- 
a/nifi-stateless/nifi-stateless-bootstrap/src/main/java/org/apache/nifi/stateless/bootstrap/AllowListClassLoader.java
+++ 
b/nifi-stateless/nifi-stateless-bootstrap/src/main/java/org/apache/nifi/stateless/bootstrap/AllowListClassLoader.java
@@ -114,9 +114,9 @@ public class AllowListClassLoader extends ClassLoader {
             if (module == null) {
                 return false;
             }
-
             final Method getName = module.getClass().getMethod("getName");
             final String moduleName = (String) getName.invoke(module);
+
             if (isModuleAllowed(moduleName)) {
                 logger.debug("Allowing Class {} because its module is {}", 
name, moduleName);
                 return true;
@@ -130,6 +130,9 @@ public class AllowListClassLoader extends ClassLoader {
     }
 
     private boolean isModuleAllowed(final String moduleName) {
+        if (moduleName == null) {
+            return false;
+        }
         for (final String prefix : allowedModulePrefixes) {
             if (moduleName.startsWith(prefix)) {
                 return true;
diff --git 
a/nifi-stateless/nifi-stateless-bootstrap/src/test/java/org/apache/nifi/stateless/bootstrap/TestAllowListClassLoader.java
 
b/nifi-stateless/nifi-stateless-bootstrap/src/test/java/org/apache/nifi/stateless/bootstrap/TestAllowListClassLoader.java
new file mode 100644
index 00000000000..47a1d9b6823
--- /dev/null
+++ 
b/nifi-stateless/nifi-stateless-bootstrap/src/test/java/org/apache/nifi/stateless/bootstrap/TestAllowListClassLoader.java
@@ -0,0 +1,67 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.nifi.stateless.bootstrap;
+
+import org.junit.jupiter.api.Test;
+
+import java.util.Collections;
+import java.util.Set;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+class TestAllowListClassLoader {
+
+    @Test
+    void testLoadClassFromUnnamedModule() {
+        final AllowListClassLoader classLoader = new AllowListClassLoader(
+                ClassLoader.getSystemClassLoader(),
+                Collections.emptySet()
+        );
+
+        assertThrows(ClassNotFoundException.class, () -> 
classLoader.loadClass(TestAllowListClassLoader.class.getName()));
+    }
+
+    @Test
+    void testLoadClassFromAllowedJavaModule() throws ClassNotFoundException {
+        final AllowListClassLoader classLoader = new AllowListClassLoader(
+                ClassLoader.getSystemClassLoader(),
+                Collections.emptySet()
+        );
+
+        final Class<?> loadedClass = classLoader.loadClass("java.lang.String");
+        assertNotNull(loadedClass);
+        assertEquals(String.class, loadedClass);
+    }
+
+    @Test
+    void testLoadExplicitlyAllowedClass() throws ClassNotFoundException {
+        final String explicitClassName = 
TestAllowListClassLoader.class.getName();
+        final Set<String> allowedClassNames = 
Collections.singleton(explicitClassName);
+
+        final AllowListClassLoader classLoader = new AllowListClassLoader(
+                ClassLoader.getSystemClassLoader(),
+                allowedClassNames
+        );
+
+        final Class<?> loadedClass = classLoader.loadClass(explicitClassName);
+        assertNotNull(loadedClass);
+        assertEquals(TestAllowListClassLoader.class, loadedClass);
+    }
+}