Possible NullPointerException in ReactiveMongoSessionRepository

[thko79]

Hi,
we had recently some errors in our application after refactoring some package names. We ended up in our research in this code line:

There you apply a filter on a nullable object. Maybe you have to filter Objects::nonNull before apply other filters, see following line:

spring-session-data-mongodb/src/main/java/org/springframework/session/data/mongo/ReactiveMongoSessionRepository.java

Lines 115 to 118 in 6088371

	return findSession(id) //
	.map(document -> convertToSession(this.mongoSessionConverter, document)) //
	.filter(mongoSession -> !mongoSession.isExpired()) //
	.switchIfEmpty(Mono.defer(() -> this.deleteById(id).then(Mono.empty())));

As you can see the result of convertToSession is nullable:

spring-session-data-mongodb/src/main/java/org/springframework/session/data/mongo/MongoSessionUtils.java

Lines 36 to 41 in 6088371

	@Nullable
	static MongoSession convertToSession(AbstractMongoSessionConverter mongoSessionConverter, Document session) {
	return (MongoSession) mongoSessionConverter.convert(session, TypeDescriptor.valueOf(Document.class),
	TypeDescriptor.valueOf(MongoSession.class));
	}

You can reproduce it by placing an invalid Document, this'll cause the ObjectMapper to throw an IOException, which is caught and null value is returned:

spring-session-data-mongodb/src/main/java/org/springframework/session/data/mongo/JacksonMongoSessionConverter.java

Lines 134 to 141 in 6088371

	try {
	MongoSession mongoSession = this.objectMapper.readValue(json, MongoSession.class);
	mongoSession.setExpireAt(expireAt);
	return mongoSession;
	} catch (IOException e) {
	LOG.error("Error during Mongo Session deserialization", e);
	return null;
	}

In our case the Documents gets invalid by refactoring of package names, so it does not match any more with the "@Class" attribute.

Greetings
Thomas