Skip to content

[BUG] ChangeUserPassword throws NPE before its null check when player is missing #973

Closed

Description

@ismisepaul

Discovered during #918.

In src/main/java/servlets/admin/userManagement/ChangeUserPassword.java:

String player = (String) request.getParameter("player");
log.debug("player = " + player.toString());
...
notNull = (player != null) && (newPassword != null);

If the player parameter is missing, player.toString() throws a NullPointerException before the null check. The generic catch (Exception e) swallows it and returns "An error Occurred! Please try again.", so the "Null values detected" / "Invalid Request" branch can never run for a missing player.

Fix: log player without calling .toString() (string concatenation already handles null), and add a test that posts without player and expects the "Invalid Request" response.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions