From 8fa656d3da5e26e14cc51e1873d4fba501833e9d Mon Sep 17 00:00:00 2001
From: Moritz Halbritter <moritz.halbritter@broadcom.com>
Date: Thu, 14 Aug 2025 14:30:51 +0200
Subject: [PATCH] Improve null-safety of build-plugin/spring-boot-maven-plugin

See gh-46926
---
 .../java/org/springframework/boot/maven/BuildImageMojo.java   | 4 +++-
 .../boot/maven/PropertiesMergingResourceTransformer.java      | 3 +++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/build-plugin/spring-boot-maven-plugin/src/main/java/org/springframework/boot/maven/BuildImageMojo.java b/build-plugin/spring-boot-maven-plugin/src/main/java/org/springframework/boot/maven/BuildImageMojo.java
index f545a77c65b..2ac7f7d5f6c 100644
--- a/build-plugin/spring-boot-maven-plugin/src/main/java/org/springframework/boot/maven/BuildImageMojo.java
+++ b/build-plugin/spring-boot-maven-plugin/src/main/java/org/springframework/boot/maven/BuildImageMojo.java
@@ -51,6 +51,7 @@ import org.springframework.boot.loader.tools.ImagePackager;
 import org.springframework.boot.loader.tools.LayoutFactory;
 import org.springframework.boot.loader.tools.Libraries;
 import org.springframework.boot.loader.tools.LoaderImplementation;
+import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;
 
 /**
@@ -454,11 +455,12 @@ public abstract class BuildImageMojo extends AbstractPackagerMojo {
 			}
 		}
 
-		private void write(ZipEntry jarEntry, EntryWriter entryWriter, TarArchiveOutputStream tar) {
+		private void write(ZipEntry jarEntry, @Nullable EntryWriter entryWriter, TarArchiveOutputStream tar) {
 			try {
 				TarArchiveEntry tarEntry = convert(jarEntry);
 				tar.putArchiveEntry(tarEntry);
 				if (tarEntry.isFile()) {
+					Assert.state(entryWriter != null, "'entryWriter' must not be null");
 					entryWriter.write(tar);
 				}
 				tar.closeArchiveEntry();
diff --git a/build-plugin/spring-boot-maven-plugin/src/main/java/org/springframework/boot/maven/PropertiesMergingResourceTransformer.java b/build-plugin/spring-boot-maven-plugin/src/main/java/org/springframework/boot/maven/PropertiesMergingResourceTransformer.java
index 4bfbb143211..aa56e026f0a 100644
--- a/build-plugin/spring-boot-maven-plugin/src/main/java/org/springframework/boot/maven/PropertiesMergingResourceTransformer.java
+++ b/build-plugin/spring-boot-maven-plugin/src/main/java/org/springframework/boot/maven/PropertiesMergingResourceTransformer.java
@@ -27,6 +27,8 @@ import org.apache.maven.plugins.shade.relocation.Relocator;
 import org.apache.maven.plugins.shade.resource.ReproducibleResourceTransformer;
 import org.jspecify.annotations.Nullable;
 
+import org.springframework.util.Assert;
+
 /**
  * Extension for the <a href="https://maven.apache.org/plugins/maven-shade-plugin/">Maven
  * shade plugin</a> to allow properties files (e.g. {@literal META-INF/spring.factories})
@@ -88,6 +90,7 @@ public class PropertiesMergingResourceTransformer implements ReproducibleResourc
 
 	@Override
 	public void modifyOutputStream(JarOutputStream os) throws IOException {
+		Assert.state(this.resource != null, "'resource' must not be null");
 		JarEntry jarEntry = new JarEntry(this.resource);
 		jarEntry.setTime(this.time);
 		os.putNextEntry(jarEntry);