This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 11.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 1c598555f222a91f700897b96d8c165cc6fa8e9e Author: opencode <[email protected]> AuthorDate: Wed Oct 14 09:38:16 2026 +0200 Avoid NPE in SimpleInstanceManager.newInstance(String) with null TCCL SimpleInstanceManager.newInstance(String) dereferenced the thread context class loader without a null check. Thread.getContextClassLoader() is documented to return null in some cases and NullPointerException is not part of the InstanceManager.newInstance(String) contract, so a raw NPE could escape to callers. Fall back to the class loader of SimpleInstanceManager when the thread context class loader is null, matching the established pattern used by JspRuntimeContext and Registry. This turns the previous undeclared NPE into the contract-declared ClassNotFoundException when the class cannot be resolved, and has no effect on the normal case where the thread context class loader is set. --- java/org/apache/tomcat/SimpleInstanceManager.java | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/java/org/apache/tomcat/SimpleInstanceManager.java b/java/org/apache/tomcat/SimpleInstanceManager.java index 8988289d2c..417e942270 100644 --- a/java/org/apache/tomcat/SimpleInstanceManager.java +++ b/java/org/apache/tomcat/SimpleInstanceManager.java @@ -43,7 +43,11 @@ public class SimpleInstanceManager implements InstanceManager { @Override public Object newInstance(String className) throws IllegalAccessException, InvocationTargetException, NamingException, InstantiationException, ClassNotFoundException, NoSuchMethodException { - Class<?> clazz = Thread.currentThread().getContextClassLoader().loadClass(className); + ClassLoader classLoader = Thread.currentThread().getContextClassLoader(); + if (classLoader == null) { + classLoader = SimpleInstanceManager.class.getClassLoader(); + } + Class<?> clazz = classLoader.loadClass(className); return clazz.getConstructor().newInstance(); } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
