[CONFSERVER-97879] Using the foreach directive with a context item that is blocked by the Introspector in a Velocity template will throw an unhandled exception

Type: Bug
Resolution: Fixed
Priority: Low
Fix Version/s: 9.3.1
Affects Version/s: 7.19.26, 9.0.1, 8.5.14
Component/s: Server - Plugin Development
Labels:
- ewt-rtb-service-operations-and-tech-entropy
- internal-kickoff

Symptom Severity:
Severity 3 - Minor
Bug Fix Policy:
View Atlassian Server bug fix policy
EWT (CtB, RtB, DP):
RtB - Service ops & Tech entropy

Issue Summary

The Velocity HtmlSafe library is interfering with the regular null handling within Velocity foreach directives, leading to undesirable behaviour.

Steps to Reproduce

Following some recent changes, it is difficult to reproduce this in a production instance as it is an edge case. Feel free to refer to ~~CONFSERVER-96642~~ for reproduction steps specific to 8.9.4.

#foreach($iter in $blockedContextItem.getValues(true))
  $iter
#end

Expected Results

The null value should be handled with more grace. A complete stack trace need not be logged. The Velocity HtmlSafe library specifically, should not be throwing any exception and know to ignore null collections.

Actual Results

Following exception is thrown and logged each time the template is rendered:

java.lang.NullPointerException
    at com.atlassian.velocity.htmlsafe.introspection.ReturnValueAnnotator.getAnnotationsForMethod(ReturnValueAnnotator.java:34)
    at com.atlassian.velocity.htmlsafe.introspection.AnnotationBoxingUberspect.getMethodAnnotations(AnnotationBoxingUberspect.java:341)
    at com.atlassian.velocity.htmlsafe.introspection.HtmlSafeAnnotationBoxingUberspect.getMethodAnnotations(HtmlSafeAnnotationBoxingUberspect.java:28)
    at com.atlassian.confluence.velocity.introspection.ConfluenceAnnotationBoxingUberspect.getMethodAnnotations(ConfluenceAnnotationBoxingUberspect.java:24)
    at com.atlassian.velocity.htmlsafe.introspection.AnnotationBoxingUberspect.getMethod(AnnotationBoxingUberspect.java:131)
    at org.apache.velocity.runtime.parser.node.ASTMethod.execute(ASTMethod.java:192)
    at org.apache.velocity.runtime.parser.node.ASTReference.execute(ASTReference.java:262)
    at org.apache.velocity.runtime.parser.node.ASTReference.value(ASTReference.java:507)
    at org.apache.velocity.runtime.parser.node.ASTExpression.value(ASTExpression.java:71)
    at org.apache.velocity.runtime.parser.node.ASTSetDirective.render(ASTSetDirective.java:142)
    at org.apache.velocity.runtime.parser.node.ASTBlock.render(ASTBlock.java:72)
    at org.apache.velocity.runtime.directive.Foreach.performIteration(Foreach.java:393)
    at org.apache.velocity.runtime.directive.Foreach.render(Foreach.java:316)
    at org.apache.velocity.runtime.parser.node.ASTDirective.render(ASTDirective.java:175)
    at org.apache.velocity.runtime.parser.node.SimpleNode.render(SimpleNode.java:336)
    at org.apache.velocity.runtime.RuntimeInstance.render(RuntimeInstance.java:1276)
    at org.apache.velocity.runtime.RuntimeInstance.evaluate(RuntimeInstance.java:1215)
    at org.apache.velocity.runtime.RuntimeInstance.evaluate(RuntimeInstance.java:1164)
    at org.apache.velocity.app.VelocityEngine.evaluate(VelocityEngine.java:219)

Workaround

Within Velocity templates, do a null check prior to invoking a foreach directive.

relates to

CONFSERVER-97514 Methods beginning with 'render' or 'getRender' that return a non-String type, will throw an exception when invoked from a Velocity template

Gathering Impact

CONFSERVER-97828 Methods ending with 'html' whose return value is passed to a Soy template, renders an unexpected String value

Gathering Impact

split from

CONFSERVER-96642 Getting java.lang.NullPointerException after calling pageManager.getPages in user macro

Closed

Akshay Kumar added a comment - 04/Feb/2025 12:32 PM

A fix for this issue is available in Confluence Server and Data Center 9.3.1. Upgrade now or check out the Release Notes to see what other issues are resolved.

Akshay Kumar added a comment - 04/Feb/2025 12:32 PM A fix for this issue is available in Confluence Server and Data Center 9.3.1. Upgrade now or check out the Release Notes to see what other issues are resolved.

Akshay Kumar made changes - 04/Feb/2025 11:14 AM

Resolution		New: Fixed [ 1 ]
Status	Original: Waiting for Release [ 12075 ]	New: Closed [ 6 ]

Akshay Kumar made changes - 28/Jan/2025 6:44 PM

Fix Version/s	Original: 9.3.0 [ 109797 ]
Fix Version/s		New: 9.3.1 [ 110904 ]

Kusal Kithul-Godage made changes - 18/Dec/2024 8:39 AM

Status

Original: Awaiting Merge [ 10064 ]

New: Waiting for Release [ 12075 ]

Kusal Kithul-Godage made changes - 18/Dec/2024 8:39 AM

QA Demo Status	Original: Not Done [ 14330 ]	New: Not Needed [ 14332 ]
Status	Original: In Review [ 10051 ]	New: Awaiting Merge [ 10064 ]

Kusal Kithul-Godage made changes - 18/Dec/2024 8:38 AM

Fix Version/s

New: 9.3.0 [ 109797 ]

Kusal Kithul-Godage made changes - 13/Nov/2024 12:16 AM

Remote Link

New: This issue links to "Plan orchestrator POC › Orchestrator › issue-~~CONFSERVER-97879~~-htmlsafe-test (server-gdn-bamboo)" [ 963398 ]

Jiri Hronik made changes - 12/Nov/2024 10:38 PM

Labels

Original: ewt-rtb-service-operations-and-tech-entropy internal-kickoff nnb-followup

New: ewt-rtb-service-operations-and-tech-entropy internal-kickoff

Kusal Kithul-Godage made changes - 12/Nov/2024 6:15 AM

Description

Original: h3. Issue Summary

The Velocity HtmlSafe library is interfering with the regular null handling within Velocity foreach directives, leading to undesirable behaviour.
h3. Steps to Reproduce

Following some recent changes, it is difficult to reproduce this in a production instance as it is an edge case. Feel free to
{code:java}
#foreach($iter in $blockedContextItem.getValues(true))
  $iter
#end{code}
h3. Expected Results

The null value should be handled with more grace. A complete stack trace need not be logged. The Velocity HtmlSafe library specifically, should not be throwing any exception and know to ignore null collections.
h3. Actual Results

Following exception is thrown and logged each time the template is rendered:
{noformat}
java.lang.NullPointerException
    at com.atlassian.velocity.htmlsafe.introspection.ReturnValueAnnotator.getAnnotationsForMethod(ReturnValueAnnotator.java:34)
    at com.atlassian.velocity.htmlsafe.introspection.AnnotationBoxingUberspect.getMethodAnnotations(AnnotationBoxingUberspect.java:341)
    at com.atlassian.velocity.htmlsafe.introspection.HtmlSafeAnnotationBoxingUberspect.getMethodAnnotations(HtmlSafeAnnotationBoxingUberspect.java:28)
    at com.atlassian.confluence.velocity.introspection.ConfluenceAnnotationBoxingUberspect.getMethodAnnotations(ConfluenceAnnotationBoxingUberspect.java:24)
    at com.atlassian.velocity.htmlsafe.introspection.AnnotationBoxingUberspect.getMethod(AnnotationBoxingUberspect.java:131)
    at org.apache.velocity.runtime.parser.node.ASTMethod.execute(ASTMethod.java:192)
    at org.apache.velocity.runtime.parser.node.ASTReference.execute(ASTReference.java:262)
    at org.apache.velocity.runtime.parser.node.ASTReference.value(ASTReference.java:507)
    at org.apache.velocity.runtime.parser.node.ASTExpression.value(ASTExpression.java:71)
    at org.apache.velocity.runtime.parser.node.ASTSetDirective.render(ASTSetDirective.java:142)
    at org.apache.velocity.runtime.parser.node.ASTBlock.render(ASTBlock.java:72)
    at org.apache.velocity.runtime.directive.Foreach.performIteration(Foreach.java:393)
    at org.apache.velocity.runtime.directive.Foreach.render(Foreach.java:316)
    at org.apache.velocity.runtime.parser.node.ASTDirective.render(ASTDirective.java:175)
    at org.apache.velocity.runtime.parser.node.SimpleNode.render(SimpleNode.java:336)
    at org.apache.velocity.runtime.RuntimeInstance.render(RuntimeInstance.java:1276)
    at org.apache.velocity.runtime.RuntimeInstance.evaluate(RuntimeInstance.java:1215)
    at org.apache.velocity.runtime.RuntimeInstance.evaluate(RuntimeInstance.java:1164)
    at org.apache.velocity.app.VelocityEngine.evaluate(VelocityEngine.java:219) {noformat}
h3. Workaround

Within Velocity templates, do a null check prior to invoking a foreach directive.

New: h3. Issue Summary

The Velocity HtmlSafe library is interfering with the regular null handling within Velocity foreach directives, leading to undesirable behaviour.
h3. Steps to Reproduce

Following some recent changes, it is difficult to reproduce this in a production instance as it is an edge case. Feel free to refer to ~~CONFSERVER-96642~~ for reproduction steps specific to 8.9.4.
{code:java}
#foreach($iter in $blockedContextItem.getValues(true))
  $iter
#end{code}
h3. Expected Results

The null value should be handled with more grace. A complete stack trace need not be logged. The Velocity HtmlSafe library specifically, should not be throwing any exception and know to ignore null collections.
h3. Actual Results

Following exception is thrown and logged each time the template is rendered:
{noformat}
java.lang.NullPointerException
    at com.atlassian.velocity.htmlsafe.introspection.ReturnValueAnnotator.getAnnotationsForMethod(ReturnValueAnnotator.java:34)
    at com.atlassian.velocity.htmlsafe.introspection.AnnotationBoxingUberspect.getMethodAnnotations(AnnotationBoxingUberspect.java:341)
    at com.atlassian.velocity.htmlsafe.introspection.HtmlSafeAnnotationBoxingUberspect.getMethodAnnotations(HtmlSafeAnnotationBoxingUberspect.java:28)
    at com.atlassian.confluence.velocity.introspection.ConfluenceAnnotationBoxingUberspect.getMethodAnnotations(ConfluenceAnnotationBoxingUberspect.java:24)
    at com.atlassian.velocity.htmlsafe.introspection.AnnotationBoxingUberspect.getMethod(AnnotationBoxingUberspect.java:131)
    at org.apache.velocity.runtime.parser.node.ASTMethod.execute(ASTMethod.java:192)
    at org.apache.velocity.runtime.parser.node.ASTReference.execute(ASTReference.java:262)
    at org.apache.velocity.runtime.parser.node.ASTReference.value(ASTReference.java:507)
    at org.apache.velocity.runtime.parser.node.ASTExpression.value(ASTExpression.java:71)
    at org.apache.velocity.runtime.parser.node.ASTSetDirective.render(ASTSetDirective.java:142)
    at org.apache.velocity.runtime.parser.node.ASTBlock.render(ASTBlock.java:72)
    at org.apache.velocity.runtime.directive.Foreach.performIteration(Foreach.java:393)
    at org.apache.velocity.runtime.directive.Foreach.render(Foreach.java:316)
    at org.apache.velocity.runtime.parser.node.ASTDirective.render(ASTDirective.java:175)
    at org.apache.velocity.runtime.parser.node.SimpleNode.render(SimpleNode.java:336)
    at org.apache.velocity.runtime.RuntimeInstance.render(RuntimeInstance.java:1276)
    at org.apache.velocity.runtime.RuntimeInstance.evaluate(RuntimeInstance.java:1215)
    at org.apache.velocity.runtime.RuntimeInstance.evaluate(RuntimeInstance.java:1164)
    at org.apache.velocity.app.VelocityEngine.evaluate(VelocityEngine.java:219) {noformat}
h3. Workaround

Within Velocity templates, do a null check prior to invoking a foreach directive.

Kusal Kithul-Godage made changes - 12/Nov/2024 6:14 AM

Description

Original: h3. Issue Summary

The Velocity HtmlSafe library is interfering with the regular null handling within Velocity foreach directives, leading to undesirable behaviour.
h3. Steps to Reproduce
# Create a User Macro (from /admin/usermacros.action)
# Enter the following:
{code:java}
#foreach($iter in $blockedContextItem.getValues(true))
  $iter
#end{code}

# Save Macro
# Create page and add/preview Macro

h3. Expected Results

The null value should be handled with more grace. A complete stack trace need not be logged. The Velocity HtmlSafe library specifically, should not be throwing any exception and know to ignore null collections.
h3. Actual Results

Following exception is thrown and logged each time the template is rendered:
{noformat}
java.lang.NullPointerException
    at com.atlassian.velocity.htmlsafe.introspection.ReturnValueAnnotator.getAnnotationsForMethod(ReturnValueAnnotator.java:34)
    at com.atlassian.velocity.htmlsafe.introspection.AnnotationBoxingUberspect.getMethodAnnotations(AnnotationBoxingUberspect.java:341)
    at com.atlassian.velocity.htmlsafe.introspection.HtmlSafeAnnotationBoxingUberspect.getMethodAnnotations(HtmlSafeAnnotationBoxingUberspect.java:28)
    at com.atlassian.confluence.velocity.introspection.ConfluenceAnnotationBoxingUberspect.getMethodAnnotations(ConfluenceAnnotationBoxingUberspect.java:24)
    at com.atlassian.velocity.htmlsafe.introspection.AnnotationBoxingUberspect.getMethod(AnnotationBoxingUberspect.java:131)
    at org.apache.velocity.runtime.parser.node.ASTMethod.execute(ASTMethod.java:192)
    at org.apache.velocity.runtime.parser.node.ASTReference.execute(ASTReference.java:262)
    at org.apache.velocity.runtime.parser.node.ASTReference.value(ASTReference.java:507)
    at org.apache.velocity.runtime.parser.node.ASTExpression.value(ASTExpression.java:71)
    at org.apache.velocity.runtime.parser.node.ASTSetDirective.render(ASTSetDirective.java:142)
    at org.apache.velocity.runtime.parser.node.ASTBlock.render(ASTBlock.java:72)
    at org.apache.velocity.runtime.directive.Foreach.performIteration(Foreach.java:393)
    at org.apache.velocity.runtime.directive.Foreach.render(Foreach.java:316)
    at org.apache.velocity.runtime.parser.node.ASTDirective.render(ASTDirective.java:175)
    at org.apache.velocity.runtime.parser.node.SimpleNode.render(SimpleNode.java:336)
    at org.apache.velocity.runtime.RuntimeInstance.render(RuntimeInstance.java:1276)
    at org.apache.velocity.runtime.RuntimeInstance.evaluate(RuntimeInstance.java:1215)
    at org.apache.velocity.runtime.RuntimeInstance.evaluate(RuntimeInstance.java:1164)
    at org.apache.velocity.app.VelocityEngine.evaluate(VelocityEngine.java:219) {noformat}
h3. Workaround

Within Velocity templates, do a null check prior to invoking a foreach directive.

New: h3. Issue Summary

The Velocity HtmlSafe library is interfering with the regular null handling within Velocity foreach directives, leading to undesirable behaviour.
h3. Steps to Reproduce

Following some recent changes, it is difficult to reproduce this in a production instance as it is an edge case. Feel free to
{code:java}
#foreach($iter in $blockedContextItem.getValues(true))
  $iter
#end{code}
h3. Expected Results

The null value should be handled with more grace. A complete stack trace need not be logged. The Velocity HtmlSafe library specifically, should not be throwing any exception and know to ignore null collections.
h3. Actual Results

Following exception is thrown and logged each time the template is rendered:
{noformat}
java.lang.NullPointerException
    at com.atlassian.velocity.htmlsafe.introspection.ReturnValueAnnotator.getAnnotationsForMethod(ReturnValueAnnotator.java:34)
    at com.atlassian.velocity.htmlsafe.introspection.AnnotationBoxingUberspect.getMethodAnnotations(AnnotationBoxingUberspect.java:341)
    at com.atlassian.velocity.htmlsafe.introspection.HtmlSafeAnnotationBoxingUberspect.getMethodAnnotations(HtmlSafeAnnotationBoxingUberspect.java:28)
    at com.atlassian.confluence.velocity.introspection.ConfluenceAnnotationBoxingUberspect.getMethodAnnotations(ConfluenceAnnotationBoxingUberspect.java:24)
    at com.atlassian.velocity.htmlsafe.introspection.AnnotationBoxingUberspect.getMethod(AnnotationBoxingUberspect.java:131)
    at org.apache.velocity.runtime.parser.node.ASTMethod.execute(ASTMethod.java:192)
    at org.apache.velocity.runtime.parser.node.ASTReference.execute(ASTReference.java:262)
    at org.apache.velocity.runtime.parser.node.ASTReference.value(ASTReference.java:507)
    at org.apache.velocity.runtime.parser.node.ASTExpression.value(ASTExpression.java:71)
    at org.apache.velocity.runtime.parser.node.ASTSetDirective.render(ASTSetDirective.java:142)
    at org.apache.velocity.runtime.parser.node.ASTBlock.render(ASTBlock.java:72)
    at org.apache.velocity.runtime.directive.Foreach.performIteration(Foreach.java:393)
    at org.apache.velocity.runtime.directive.Foreach.render(Foreach.java:316)
    at org.apache.velocity.runtime.parser.node.ASTDirective.render(ASTDirective.java:175)
    at org.apache.velocity.runtime.parser.node.SimpleNode.render(SimpleNode.java:336)
    at org.apache.velocity.runtime.RuntimeInstance.render(RuntimeInstance.java:1276)
    at org.apache.velocity.runtime.RuntimeInstance.evaluate(RuntimeInstance.java:1215)
    at org.apache.velocity.runtime.RuntimeInstance.evaluate(RuntimeInstance.java:1164)
    at org.apache.velocity.app.VelocityEngine.evaluate(VelocityEngine.java:219) {noformat}
h3. Workaround

Within Velocity templates, do a null check prior to invoking a foreach directive.

Assignee:: Kusal Kithul-Godage

Reporter:: Kusal Kithul-Godage

Affected customers:: 1 This affects my team

Watchers:: 4 Start watching this issue

Created:: 09/Sep/2024 3:18 AM

Updated:: 04/Feb/2025 12:32 PM

Resolved:: 04/Feb/2025 11:14 AM

Details

Description

Issue Summary

Steps to Reproduce

Expected Results

Actual Results

Workaround

Attachments

Issue Links

Forms

Activity

Collapse comment: Akshay Kumar added a comment - 04/Feb/2025 12:32 PM

Expand comment: Akshay Kumar added a comment - 04/Feb/2025 12:32 PM

People

Dates