NPE in BasicAuthHeaderAutoLogin

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.0.0 M7
• Fix Version/s: 7.0.0 Alpha 1
• Component/s: Application Security, Security Vulnerability
• Labels: None
• Story Points: 6
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/30301

1. Enable debug logging for com.liferay.portal.security.auth.AuthVerifierPipeline
2. Go to control panel, portal settings
3. Observe:

01:38:28,564 DEBUG [http-bio-8080-exec-3][AuthVerifierPipeline:256] Skipping com.liferay.portal.security.auth.verifier.basic.auth.header.BasicAuthHeaderAuthVerifier
com.liferay.portal.security.auth.AuthException: com.liferay.portal.kernel.security.auto.login.AutoLoginException: java.lang.NullPointerException
	at com.liferay.portal.security.auth.verifier.basic.auth.header.BasicAuthHeaderAuthVerifier.verify(BasicAuthHeaderAuthVerifier.java:97)
	at com.liferay.portal.security.auth.AuthVerifierPipeline._verifyRequest(AuthVerifierPipeline.java:249)
	at com.liferay.portal.security.auth.AuthVerifierPipeline.verifyRequest(AuthVerifierPipeline.java:68)
	at com.liferay.portal.security.access.control.AccessControlImpl.verifyRequest(AccessControlImpl.java:98)
	at com.liferay.portal.kernel.security.access.control.AccessControlUtil.verifyRequest(AccessControlUtil.java:102)
	at com.liferay.portal.servlet.filters.authverifier.AuthVerifierFilter.processFilter(AuthVerifierFilter.java:133)
	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:48)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:207)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:112)
	at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:133)
	at com.liferay.portal.servlet.filters.jsoncontenttype.JSONContentTypeFilter.processFilter(JSONContentTypeFilter.java:42)
	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:48)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:207)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:112)
	at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:133)
	at com.liferay.portal.sharepoint.SharepointFilter.processFilter(SharepointFilter.java:88)
	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:48)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:207)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:112)
	at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:133)
	at com.liferay.portal.servlet.filters.virtualhost.VirtualHostFilter.processFilter(VirtualHostFilter.java:225)
	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:48)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:207)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:112)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:188)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:96)
	at org.tuckey.web.filters.urlrewrite.RuleChain.handleRewrite(RuleChain.java:176)
	at org.tuckey.web.filters.urlrewrite.RuleChain.doRules(RuleChain.java:145)
	at org.tuckey.web.filters.urlrewrite.UrlRewriter.processRequest(UrlRewriter.java:92)
	at org.tuckey.web.filters.urlrewrite.UrlRewriteFilter.doFilter(UrlRewriteFilter.java:394)
	at com.liferay.portal.servlet.filters.urlrewrite.UrlRewriteFilter.processFilter(UrlRewriteFilter.java:65)
	at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:48)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDoFilter(InvokerFilterChain.java:207)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:112)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:168)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:96)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:168)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:96)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.processDirectCallFilter(InvokerFilterChain.java:188)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilterChain.doFilter(InvokerFilterChain.java:96)
	at com.liferay.portal.kernel.servlet.filters.invoker.InvokerFilter.doFilter(InvokerFilter.java:115)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
	at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:957)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:423)
	at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1079)
	at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:620)
	at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:318)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
	at java.lang.Thread.run(Thread.java:744)
Caused by: com.liferay.portal.kernel.security.auto.login.AutoLoginException: java.lang.NullPointerException
	at com.liferay.portal.kernel.security.auto.login.BaseAutoLogin.doHandleException(BaseAutoLogin.java:69)
	at com.liferay.portal.kernel.security.auto.login.BaseAutoLogin.handleException(BaseAutoLogin.java:37)
	at com.liferay.portal.kernel.security.auto.login.BaseAutoLogin.login(BaseAutoLogin.java:49)
	at com.liferay.portal.security.auth.verifier.basic.auth.header.BasicAuthHeaderAuthVerifier.verify(BasicAuthHeaderAuthVerifier.java:62)
	... 57 more
Caused by: java.lang.NullPointerException
	at com.liferay.portal.security.auto.login.basic.auth.header.BasicAuthHeaderAutoLogin.doLogin(BasicAuthHeaderAutoLogin.java:91)
	at com.liferay.portal.kernel.security.auto.login.BaseAutoLogin.login(BaseAutoLogin.java:46)
	... 58 more