[maven-4.0.x] DefaultModelBuilder: NPE from null source location in parentChain set

[elharo]

DefaultModelBuilder: NPE from null source location in parentChain set

Found in: maven-4.0.x branch
File: impl/maven-impl/src/main/java/org/apache/maven/impl/model/DefaultModelBuilder.java (lines 1164-1166)
Severity: Medium

Description

ModelSource.getLocation() has a @Nullable contract, but its return value is passed directly to parentChain.add():

String sourceLocation = candidateSource.getLocation();
if (!parentChain.add(sourceLocation)) {  // NPE if null

parentChain is a LinkedHashSet, and most Set implementations (including LinkedHashSet) do not allow null elements. If candidateSource.getLocation() returns null, Set.add(null) throws a NullPointerException. This can be triggered when resolving parent POMs from non-file sources.