Check for null Name Attribute Value

Closes spring-projectsgh-15338
HyoJongPark · Jul 12, 2024 · d991019 · d991019
1 parent beff600
commit d991019
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 5 deletions.
diff --git a/...2-core/src/main/java/org/springframework/security/oauth2/core/user/DefaultOAuth2User.java b/...2-core/src/main/java/org/springframework/security/oauth2/core/user/DefaultOAuth2User.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2021 the original author or authors.
+ * Copyright 2002-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -44,6 +44,7 @@
  *
  * @author Joe Grandja
  * @author Eddú Meléndez
+ * @author Park Hyojong
  * @since 5.0
  * @see OAuth2User
  */
@@ -68,9 +69,8 @@ public DefaultOAuth2User(Collection<? extends GrantedAuthority> authorities, Map
 			String nameAttributeKey) {
 		Assert.notEmpty(attributes, "attributes cannot be empty");
 		Assert.hasText(nameAttributeKey, "nameAttributeKey cannot be empty");
-		if (!attributes.containsKey(nameAttributeKey)) {
-			throw new IllegalArgumentException("Missing attribute '" + nameAttributeKey + "' in attributes");
-		}
+		Assert.notNull(attributes.get(nameAttributeKey), "Attribute value for '" + nameAttributeKey + "' cannot be null");
+
 		this.authorities = (authorities != null)
 				? Collections.unmodifiableSet(new LinkedHashSet<>(this.sortAuthorities(authorities)))
 				: Collections.unmodifiableSet(new LinkedHashSet<>(AuthorityUtils.NO_AUTHORITIES));

diff --git a/...e/src/test/java/org/springframework/security/oauth2/core/user/DefaultOAuth2UserTests.java b/...e/src/test/java/org/springframework/security/oauth2/core/user/DefaultOAuth2UserTests.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2021 the original author or authors.
+ * Copyright 2002-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -34,6 +34,7 @@
  *
  * @author Vedran Pavic
  * @author Joe Grandja
+ * @author Park Hyojong
  */
 public class DefaultOAuth2UserTests {
 
@@ -59,6 +60,12 @@ public void constructorWhenAttributesIsEmptyThenThrowIllegalArgumentException()
 			.isThrownBy(() -> new DefaultOAuth2User(AUTHORITIES, Collections.emptyMap(), ATTRIBUTE_NAME_KEY));
 	}
 
+	@Test
+	public void constructorWhenAttributeValueIsNullThenThrowIllegalArgumentException() {
+		assertThatIllegalArgumentException().isThrownBy(() -> new DefaultOAuth2User(AUTHORITIES,
+				Collections.singletonMap(ATTRIBUTE_NAME_KEY, null), ATTRIBUTE_NAME_KEY));
+	}
+
 	@Test
 	public void constructorWhenNameAttributeKeyIsNullThenThrowIllegalArgumentException() {
 		assertThatIllegalArgumentException().isThrownBy(() -> new DefaultOAuth2User(AUTHORITIES, ATTRIBUTES, null));