MethodParameter.isOptional() fails with ArrayIndexOutOfBoundsException [SPR-17629]

[spring-projects-issues]

shollander opened SPR-17629 and commented

Calling org.springframework.core.MethodParameter.isOptional() can fail with an ArrayIndexOutOfBoundsException. I have a custom ResponseBodyAdvice class that calls this method in supports(). It fails when it hits org.springframework.boot.actuate.endpoint.web.servelt.WebMvcEndpointHandlerMappings$WebMvcLinksHandler.links with the following exception:

java.lang.ArrayIndexOutOfBoundsException: -1
    at org.springframework.web.method.HandlerMethod$HandlerMethodParamater.getParameterAnnotations(HandlerMethod.java:484) ~[spring-web-5.1.3.RELEASE.jar:5.1.3.RELEASE]
    at org.springframework.core.MethodParameter.hasNullableAnnotation(MethodParameter.java:357) ~[spring-core-5.1.3.RELEASE.jar:5.1.3.RELEASE]
    at org.springframework.core.MethodParameter.isOptional(MethodParameter.java:345) ~[spring-core-5.1.3.RELEASE.jar:5.1.3.RELEASE]
    at com.example.advice.OptionalResponseBodyAdvice.supports(OptionalResponseBodyAdvice.java:18) ~[main/:na]
    at org.springframework.web.servlet.mvc.method.annotation.RequestBodyAdviceChain.processBody(RequestBodyAdviceChain.java:140) ~[spring-webmvc-5.1.3.RELEASE.jar:5.1.3.RELEASE]

---

Affects: 5.1.3

Issue Links:

• Enable REST controller method parameter annotations on an interface [SPR-11055] #15682 Enable REST controller method parameter annotations on an interface

Referenced from: commits 1faeeae

[shollander]

@jhoeller This issue has not been fixed in 5.1.4. I still get the same ArrayIndexOutOfBoundsException, this time at line 486:

java.lang.ArrayIndexOutOfBoundsException: -1
    at org.springframework.web.method.HandlerMethod$HandlerMethodParamater.getParameterAnnotations(HandlerMethod.java:486) ~[spring-web-5.1.4.RELEASE.jar:5.1.4.RELEASE]
    at org.springframework.core.MethodParameter.hasNullableAnnotation(MethodParameter.java:357) ~[spring-core-5.1.4.RELEASE.jar:5.1.4.RELEASE]
    at org.springframework.core.MethodParameter.isOptional(MethodParameter.java:345) ~[spring-core-5.1.4.RELEASE.jar:5.1.4.RELEASE]
    at com.example.advice.OptionalResponseBodyAdvice.supports(OptionalResponseBodyAdvice.java:19) ~[main/:na]
    at org.springframework.web.servlet.mvc.method.annotation.RequestBodyAdviceChain.processBody(RequestBodyAdviceChain.java:140) ~[spring-webmvc-5.1.4.RELEASE.jar:5.1.4.RELEASE]

The problem is that the getParameterIndex() method called at

spring-framework/spring-web/src/main/java/org/springframework/web/method/HandlerMethod.java

Line 484 in 1faeeae

int index = getParameterIndex();

will return -1 (as documented in its JavaDoc) in the case of a return type. The change in 1faeeae only addresses checking the upper bounds of index but not the lower bounds.

[rstoyanchev]

I've edited your comment to improve the formatting. You might want to check out this Mastering Markdown guide for future reference.

[shollander]

@rstoyanchev Thank you.

[jhoeller]

I've created #22303 as a follow-up for 5.1.5, leaving this one as the ticket for the 5.1.4 release.

[Moonergfp]

The 5.1.5 release notes don't contain the update, do they? i don't find it out.
https://github.com/spring-projects/spring-framework/releases?page=9

[bclozel]

@Moonergfp I'm seeing it listed under the bugs section on the release page: https://github.com/spring-projects/spring-framework/releases/tag/v5.1.5.RELEASE

[Moonergfp]

I see, but what is the difference between these two release notes? And why does the description in https://github.com/spring-projects/spring-framework/releases?page=9 have fewer details than https://github.com/spring-projects/spring-framework/releases/tag/v5.1.5.RELEASE?
@bclozel

[bclozel]

@Moonergfp The first link is a link to a page, a collection of releases. The second link is a link to a single release.

[Moonergfp]

@bclozel But the description content in the first link, regarding v5.1.5.RELEASE, is less detailed than the second

[bclozel]

I don't see a v5.1.5.RELEASE release on that page.