A DESCRIPTION OF THE PROBLEM :
JDK-8211018 / c2398053ee90 introduced a new SSLSessionImpl constructor that initializes the final variable "boundValues" to null ... but none of the existing code in that class that references boundValues guards against the possibiility of this variable being null, resulting in NullPointerExceptions from methods such as getValue, putValue, getValueNames(), etc..

This manifests in Apache Solr testing (using jetty 9.4.19.v20190610) as...

java.lang.NullPointerException
at java.base/sun.security.ssl.SSLSessionImpl.getValue(SSLSessionImpl.java:1253)
at org.eclipse.jetty.server.SecureRequestCustomizer.customize(SecureRequestCustomizer.java:230)
at org.eclipse.jetty.server.SecureRequestCustomizer.customize(SecureRequestCustomizer.java:170)
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:363)
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:267)
at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:305)
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103)
at org.eclipse.jetty.io.ssl.SslConnection$1.run(SslConnection.java:144)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:781)
at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:917)
at java.base/java.lang.Thread.run(Thread.java:830)

NOTE: I am not an SSL expert, and do not pretend to grasp the motivation behind JDK-8211018 -- based on the description of that issue it's certainly possible that it's entirely intentional that boundValues = null in these code paths, and that the getValues/setValues/etc methods should not be used in these circustances -- but even if that is true it seems like the methods need to be updated to include null checks and throw something like IllegalStateException

http://hg.openjdk.java.net/jdk/jdk13/diff/c2398053ee90/src/java.base/share/classes/sun/security/ssl/SSLSessionImpl.java
http://hg.openjdk.java.net/jdk/jdk13/diff/c2398053ee90/src/java.base/share/classes/sun/security/ssl/SSLSessionImpl.java

REGRESSION : Last worked in version 13


FREQUENCY : always