This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit f5fb7550d0b42e8be042a63d62f8b12f9c018c5d Author: opencode <[email protected]> AuthorDate: Wed Oct 14 09:38:16 2026 +0200 Avoid NPE in SimpleInstanceManager.newInstance(String) with null TCCL SimpleInstanceManager.newInstance(String) dereferenced the thread context class loader without a null check. Thread.getContextClassLoader() is documented to return null in some cases and NullPointerException is not part of the InstanceManager.newInstance(String) contract, so a raw NPE could escape to callers. Fall back to the class loader of SimpleInstanceManager when the thread context class loader is null, matching the established pattern used by JspRuntimeContext and Registry. This turns the previous undeclared NPE into the contract-declared ClassNotFoundException when the class cannot be resolved, and has no effect on the normal case where the thread context class loader is set. --- java/org/apache/tomcat/SimpleInstanceManager.java | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/java/org/apache/tomcat/SimpleInstanceManager.java b/java/org/apache/tomcat/SimpleInstanceManager.java index 8988289d2c..417e942270 100644 --- a/java/org/apache/tomcat/SimpleInstanceManager.java +++ b/java/org/apache/tomcat/SimpleInstanceManager.java @@ -43,7 +43,11 @@ public class SimpleInstanceManager implements InstanceManager { @Override public Object newInstance(String className) throws IllegalAccessException, InvocationTargetException, NamingException, InstantiationException, ClassNotFoundException, NoSuchMethodException { - Class<?> clazz = Thread.currentThread().getContextClassLoader().loadClass(className); + ClassLoader classLoader = Thread.currentThread().getContextClassLoader(); + if (classLoader == null) { + classLoader = SimpleInstanceManager.class.getClassLoader(); + } + Class<?> clazz = classLoader.loadClass(className); return clazz.getConstructor().newInstance(); } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
