elharo opened a new issue, #145: URL: https://github.com/apache/maven-jarsigner-plugin/issues/145
**Affected version:** HEAD **Files:** - `src/main/java/org/apache/maven/plugins/jarsigner/AbstractJarsignerMojo.java:376` - `src/main/java/org/apache/maven/plugins/jarsigner/JarsignerSignMojo.java:251` Both `getCommandlineInfo()` methods call `StringUtils.replace(commandLineInfo, this.storepass/keypass, mask)` where the password field can be null when the user hasn't configured a `storepass` or `keypass`: ```java // AbstractJarsignerMojo.java:376 commandLineInfo = StringUtils.replace(commandLineInfo, this.storepass, "'*****'"); // JarsignerSignMojo.java:251 commandLineInfo = StringUtils.replace(commandLineInfo, this.keypass, "'*****'"); ``` If `StringUtils.replace` delegates to `String.replace(CharSequence, CharSequence)` (which throws NPE on null target), this crashes whenever jarsigner returns a non-zero exit code and tries to log the command line, but the user hasn't set a password. The fix should guard the call: only attempt replacement when the password is non-null. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
