[LPS-58751] NPE in BasicAuthHeaderAutoLogin - Liferay Issues

XML

Word

Printable

Details

Type: Bug
Status: Closed
Resolution: Fixed
Affects Version/s: 7.0.0 M7
Fix Version/s: 7.0.0 Alpha 1
Component/s: Application Security, Security Vulnerability
Labels:
None

Story Points:
6
Git Pull Request:
https://github.com/brianchandotcom/liferay-portal/pull/30301

Description

Enable debug logging for com.liferay.portal.security.auth.AuthVerifierPipeline
Go to control panel, portal settings
Observe:

01:38:28,564 DEBUG [http-bio-8080-exec-3][AuthVerifierPipeline:256] Skipping com.liferay.portal.security.auth.verifier.basic.auth.header.BasicAuthHeaderAuthVerifier
com.liferay.portal.security.auth.AuthException: com.liferay.portal.kernel.security.auto.login.AutoLoginException: java.lang.NullPointerException
	at com.liferay.portal.security.auth.verifier.basic.auth.header.BasicAuthHeaderAuthVerifier.verify(BasicAuthHeaderAuthVerifier.java:97)
	at com.liferay.portal.security.auth.AuthVerifierPipeline._verifyRequest(AuthVerifierPipeline.java:249)
	at com.liferay.portal.security.auth.AuthVerifierPipeline.verifyRequest(AuthVerifierPipeline.java:68)
	at com.liferay.portal.security.access.control.AccessControlImpl.verifyRequest(AccessControlImpl.java:98)
	at com.liferay.portal.kernel.security.access.control.AccessControlUtil.verifyRequest(AccessControlUtil.java:102)
	at com.liferay.portal.servlet.filters.authverifier.AuthVerifierFilter.processFilter(AuthVerifierFilter.java:133)
	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:48)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:207)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:112)
	at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:133)
	at com.liferay.portal.servlet.filters.jsoncontenttype.JSONContentTypeFilter.processFilter(JSONContentTypeFilter.java:42)
	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:48)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:207)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:112)
	at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:133)
	at com.liferay.portal.sharepoint.SharepointFilter.processFilter(SharepointFilter.java:88)
	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:48)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:207)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:112)
	at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:133)
	at com.liferay.portal.servlet.filters.virtualhost.VirtualHostFilter.processFilter(VirtualHostFilter.java:225)
	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:48)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:207)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:112)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:188)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:96)
	at org.tuckey.web.filters.urlrewrite.RuleChain.handleRewrite(RuleChain.java:176)
	at org.tuckey.web.filters.urlrewrite.RuleChain.doRules(RuleChain.java:145)
	at org.tuckey.web.filters.urlrewrite.UrlRewriter.processRequest(UrlRewriter.java:92)
	at org.tuckey.web.filters.urlrewrite.UrlRewriteFilter.doFilter(UrlRewriteFilter.java:394)
	at com.liferay.portal.servlet.filters.urlrewrite.UrlRewriteFilter.processFilter(UrlRewriteFilter.java:65)
	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:48)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:207)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:112)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:168)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:96)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:168)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:96)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:188)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:96)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilter.doFilter(InvokerFilter.java:115)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
	at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:957)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:423)
	at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1079)
	at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:620)
	at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:318)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
	at java.lang.Thread.run(Thread.java:744)
Caused by: com.liferay.portal.kernel.security.auto.login.AutoLoginException: java.lang.NullPointerException
	at com.liferay.portal.kernel.security.auto.login.BaseAutoLogin.doHandleException(BaseAutoLogin.java:69)
	at com.liferay.portal.kernel.security.auto.login.BaseAutoLogin.handleException(BaseAutoLogin.java:37)
	at com.liferay.portal.kernel.security.auto.login.BaseAutoLogin.login(BaseAutoLogin.java:49)
	at com.liferay.portal.security.auth.verifier.basic.auth.header.BasicAuthHeaderAuthVerifier.verify(BasicAuthHeaderAuthVerifier.java:62)
	... 57 more
Caused by: java.lang.NullPointerException
	at com.liferay.portal.security.auto.login.basic.auth.header.BasicAuthHeaderAutoLogin.doLogin(BasicAuthHeaderAutoLogin.java:91)
	at com.liferay.portal.kernel.security.auto.login.BaseAutoLogin.login(BaseAutoLogin.java:46)
	... 58 more

Attachments

Options
- Sort By Name
- Sort By Date
- Ascending
- Descending
- Thumbnails
- List
- Download All

Attachments

fixed.png
106 kB
20/Sep/15 11:04 PM
reproduced.png
83 kB
20/Sep/15 11:04 PM

Activity

People

Assignee:: Hong Zhao (Inactive)

Reporter:: Shinn Lok (Inactive)

Participants of an Issue:: Hong Zhao, Shinn Lok

Recent user:: Esther Sanz

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 17/Sep/15 6:40 PM

Updated:: 02/Dec/15 4:46 AM

Resolved:: 17/Sep/15 9:47 PM

Days since last comment:: 6 years, 18 weeks, 3 days ago

Packages

Version	Package
7.0.0 Alpha 1