(zeppelin) branch master updated: [ZEPPELIN-6530] Fix operator precedence in SSL store path checks and make isWindowsPath null-safe

[chanholee]

This is an automated email from the ASF dual-hosted git repository.

tbonelee pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/zeppelin.git


The following commit(s) were added to refs/heads/master by this push:
     new c11fe272ea [ZEPPELIN-6530] Fix operator precedence in SSL store path 
checks and make isWindowsPath null-safe
c11fe272ea is described below

commit c11fe272ea01d17e26218453b48a72044b980d4f
Author: 김동환 <66408194+dev-dongh...@users.noreply.github.com>
AuthorDate: Fri Jul 31 00:23:32 2026 +0900

    [ZEPPELIN-6530] Fix operator precedence in SSL store path checks and make 
isWindowsPath null-safe
    
    ### What is this PR for?
    `getKeyStorePath()` and `getTrustStorePath()` in `ZeppelinConfiguration` 
contain
    a mis-parenthesized condition:
    
    ```java
    if (path != null && path.startsWith("/") || isWindowsPath(path)) {
    ```
    
    The condition is meant to answer a single question — "is `path` an absolute
    path (Unix `/...` or Windows `C:\...`)?" — with `path != null` guarding the
    whole check. But since `&&` binds tighter than `||`, it actually parses as
    `(path != null && path.startsWith("/")) || isWindowsPath(path)`, leaving
    `isWindowsPath(path)` outside the null guard. `isWindowsPath` dereferences 
its
    argument, so a null `path` would throw an NPE.
    
    Note on reachability: with the current defaults this NPE is latent rather 
than
    user-facing. `ZEPPELIN_SSL_KEYSTORE_PATH` has a non-null default 
(`"keystore"`),
    so `getKeyStorePath()` never sees a null path, and `getTrustStorePath()` 
falls
    back to `getKeyStorePath()` when the truststore path is unset. So this PR 
is a
    correctness/hardening fix, not a fix for a currently reproducible crash.
    
    This PR:
    - restores the intended grouping in both methods —
      `path != null && (path.startsWith("/") || isWindowsPath(path))` — matching
      the correctly-parenthesized pattern already used in `getAbsoluteDir()` in 
the
      same class
    - makes `isWindowsPath(null)` return `false` instead of throwing, as defense
      in depth
    
    ### What type of PR is it?
    Bug Fix
    
    ### Todos
    * [x] - Add the missing parentheses in `getKeyStorePath()` / 
`getTrustStorePath()`
    * [x] - Make `isWindowsPath` null-safe
    * [x] - Add a unit test for `isWindowsPath(null)`
    
    ### What is the Jira issue?
    * https://issues.apache.org/jira/browse/ZEPPELIN-6530
    
    ### How should this be tested?
    * `./mvnw test -pl zeppelin-server -Dtest=ZeppelinConfigurationTest`
    * The new `isWindowsPathTestNull` asserts `isWindowsPath(null)` returns 
`false`
      (it threw an NPE before this change), following the existing
      `isWindowsPathTestTrue` / `isWindowsPathTestFalse` convention.
    
    ### Screenshots (if appropriate)
    N/A
    
    ### Questions:
    * Does the license files need to update? No
    * Is there breaking changes for older versions? No — behavior is unchanged 
for
      all reachable inputs; only the (previously unreachable) null case changes 
from
      NPE to the intended relative-path fallback
    * Does this needs documentation? No
    
    
    Closes #5353 from dev-donghwan/ZEPPELIN-6530.
    
    Signed-off-by: ChanHo Lee <chanho...@apache.org>
---
 .../main/java/org/apache/zeppelin/conf/ZeppelinConfiguration.java | 6 +++---
 .../java/org/apache/zeppelin/conf/ZeppelinConfigurationTest.java  | 8 ++++++++
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git 
a/zeppelin-server/src/main/java/org/apache/zeppelin/conf/ZeppelinConfiguration.java
 
b/zeppelin-server/src/main/java/org/apache/zeppelin/conf/ZeppelinConfiguration.java
index 252fd51a9b..179dcce6e8 100644
--- 
a/zeppelin-server/src/main/java/org/apache/zeppelin/conf/ZeppelinConfiguration.java
+++ 
b/zeppelin-server/src/main/java/org/apache/zeppelin/conf/ZeppelinConfiguration.java
@@ -353,7 +353,7 @@ public class ZeppelinConfiguration {
 
   public String getKeyStorePath() {
     String path = getString(ConfVars.ZEPPELIN_SSL_KEYSTORE_PATH);
-    if (path != null && path.startsWith("/") || isWindowsPath(path)) {
+    if (path != null && (path.startsWith("/") || isWindowsPath(path))) {
       return path;
     } else {
       return getAbsoluteDir(
@@ -385,7 +385,7 @@ public class ZeppelinConfiguration {
     if (path == null) {
       path = getKeyStorePath();
     }
-    if (path != null && path.startsWith("/") || isWindowsPath(path)) {
+    if (path != null && (path.startsWith("/") || isWindowsPath(path))) {
       return path;
     } else {
       return getAbsoluteDir(
@@ -667,7 +667,7 @@ public class ZeppelinConfiguration {
   }
 
   public boolean isWindowsPath(String path){
-    return path.matches("^[A-Za-z]:\\\\.*");
+    return path != null && path.matches("^[A-Za-z]:\\\\.*");
   }
 
   public boolean isPathWithScheme(String path){
diff --git 
a/zeppelin-server/src/test/java/org/apache/zeppelin/conf/ZeppelinConfigurationTest.java
 
b/zeppelin-server/src/test/java/org/apache/zeppelin/conf/ZeppelinConfigurationTest.java
index 63fcd0da21..a5cb0037fd 100644
--- 
a/zeppelin-server/src/test/java/org/apache/zeppelin/conf/ZeppelinConfigurationTest.java
+++ 
b/zeppelin-server/src/test/java/org/apache/zeppelin/conf/ZeppelinConfigurationTest.java
@@ -72,6 +72,14 @@ class ZeppelinConfigurationTest {
     assertFalse(isIt);
   }
 
+  @Test
+  void isWindowsPathTestNull() {
+
+    ZeppelinConfiguration zConf = 
ZeppelinConfiguration.load("zeppelin-test-site.xml");
+    Boolean isIt = zConf.isWindowsPath(null);
+    assertFalse(isIt);
+  }
+
   @Test
   void isPathWithSchemeTestTrue() {