Closed
Description
Describe the bug
Polaris currently uses Dropwizard and relies on Jackson for configuration, but also ties initialization/setup/business logic into configuration objects.
For example in PolarisApplicationConfig
there are:
@JsonProperty("realmContextResolver")
@JsonTypeInfo(use = JsonTypeInfo.Id.NAME, include = JsonTypeInfo.As.PROPERTY, property = "type")
public void setRealmContextResolver(RealmContextResolver realmContextResolver) {
this.realmContextResolver = realmContextResolver;
}
@JsonProperty("defaultRealm")
public void setDefaultRealm(String defaultRealm) {
this.defaultRealm = defaultRealm;
realmContextResolver.setDefaultRealm(defaultRealm);
}
These code constructs are racy/error-prone, because literally nothing guarantees that realmContextResolver
is set to != null
when setDefaultRealm()
is invoked.