Fix NPE in preemptive digest auth, see AsyncHttpClient#1355

Author: slandelle

client/src/main/java/org/asynchttpclient/Realm.java

@@ -218,7 +218,7 @@ protected MessageDigest initialValue() {
                 }
             }
         };
-        
+
         private static MessageDigest getMessageDigest() {
             MessageDigest md = DIGEST_TL.get();
             md.reset();
@@ -457,21 +457,24 @@ private void appendDataBase(StringBuilder sb) {
         }
 
         private void newResponse(MessageDigest md) {
-            // BEWARE: compute first as it uses the cached StringBuilder
-            String digestUri = AuthenticatorUtils.computeRealmURI(uri, useAbsoluteURI, omitQuery);
+            // when using preemptive auth, the request uri is missing
+            if (uri != null) {
+                // BEWARE: compute first as it uses the cached StringBuilder
+                String digestUri = AuthenticatorUtils.computeRealmURI(uri, useAbsoluteURI, omitQuery);
 
-            StringBuilder sb = StringBuilderPool.DEFAULT.stringBuilder();
+                StringBuilder sb = StringBuilderPool.DEFAULT.stringBuilder();
 
-            // WARNING: DON'T MOVE, BUFFER IS RECYCLED!!!!
-            byte[] secretDigest = secretDigest(sb, md);
-            byte[] dataDigest = dataDigest(sb, digestUri, md);
+                // WARNING: DON'T MOVE, BUFFER IS RECYCLED!!!!
+                byte[] secretDigest = secretDigest(sb, md);
+                byte[] dataDigest = dataDigest(sb, digestUri, md);
 
-            appendBase16(sb, secretDigest);
-            appendDataBase(sb);
-            appendBase16(sb, dataDigest);
+                appendBase16(sb, secretDigest);
+                appendDataBase(sb);
+                appendBase16(sb, dataDigest);
 
-            byte[] responseDigest = md5FromRecycledStringBuilder(sb, md);
-            response = toHexString(responseDigest);
+                byte[] responseDigest = md5FromRecycledStringBuilder(sb, md);
+                response = toHexString(responseDigest);
+            }
         }
 
         /**

client/src/main/java/org/asynchttpclient/netty/request/NettyRequestFactory.java

@@ -210,10 +210,10 @@ public NettyRequest newNettyRequest(Request request, boolean forceConnect, Proxy
             headers.set(HOST, hostHeader(request, uri));
 
         // don't override authorization but append
-        addAuthorizationHeader(headers, perRequestAuthorizationHeader(realm));
+        addAuthorizationHeader(headers, perRequestAuthorizationHeader(request, realm));
         // only set proxy auth on request over plain HTTP, or when performing CONNECT
         if (!uri.isSecured() || connect) {
-            setProxyAuthorizationHeader(headers, perRequestProxyAuthorizationHeader(proxyRealm));
+            setProxyAuthorizationHeader(headers, perRequestProxyAuthorizationHeader(request, proxyRealm));
         }
 
         // Add default accept headers

client/src/main/java/org/asynchttpclient/util/AuthenticatorUtils.java

@@ -14,6 +14,7 @@
 
 import static io.netty.handler.codec.http.HttpHeaderNames.PROXY_AUTHORIZATION;
 import static java.nio.charset.StandardCharsets.ISO_8859_1;
+import static org.asynchttpclient.Dsl.realm;
 import static org.asynchttpclient.util.HttpUtils.getNonEmptyPath;
 import static org.asynchttpclient.util.MiscUtils.isNonEmpty;
 
@@ -123,7 +124,7 @@ public static String perConnectionProxyAuthorizationHeader(Request request, Real
         return proxyAuthorization;
     }
 
-    public static String perRequestProxyAuthorizationHeader(Realm proxyRealm) {
+    public static String perRequestProxyAuthorizationHeader(Request request, Realm proxyRealm) {
 
         String proxyAuthorization = null;
         if (proxyRealm != null && proxyRealm.isUsePreemptiveAuth()) {
@@ -133,8 +134,14 @@ public static String perRequestProxyAuthorizationHeader(Realm proxyRealm) {
                 proxyAuthorization = computeBasicAuthentication(proxyRealm);
                 break;
             case DIGEST:
-                if (isNonEmpty(proxyRealm.getNonce()))
+                if (isNonEmpty(proxyRealm.getNonce())) {
+                    // update realm with request information
+                    proxyRealm = realm(proxyRealm)//
+                            .setUri(request.getUri())//
+                            .setMethodName(request.getMethod())//
+                            .build();
                     proxyAuthorization = computeDigestAuthentication(proxyRealm);
+                }
                 break;
             case NTLM:
             case KERBEROS:
@@ -183,7 +190,7 @@ else if (request.getVirtualHost() != null)
         return authorizationHeader;
     }
 
-    public static String perRequestAuthorizationHeader(Realm realm) {
+    public static String perRequestAuthorizationHeader(Request request, Realm realm) {
 
         String authorizationHeader = null;
 
@@ -194,8 +201,14 @@ public static String perRequestAuthorizationHeader(Realm realm) {
                 authorizationHeader = computeBasicAuthentication(realm);
                 break;
             case DIGEST:
-                if (isNonEmpty(realm.getNonce()))
+                if (isNonEmpty(realm.getNonce())) {
+                    // update realm with request information
+                    realm = realm(realm)//
+                            .setUri(request.getUri())//
+                            .setMethodName(request.getMethod())//
+                            .build();
                     authorizationHeader = computeDigestAuthentication(realm);
+                }
                 break;
             case NTLM:
             case KERBEROS:

client/src/test/java/org/asynchttpclient/AuthTimeoutTest.java

@@ -165,6 +165,9 @@ protected Future<Response> execute(AsyncHttpClient client, boolean basic, boolea
             realm = digestAuthRealm(USER, ADMIN);
             url = getTargetUrl2();
             if (preemptive) {
+                realm.setRealmName("MyRealm");
+                realm.setAlgorithm("MD5");
+                realm.setQop("auth");
                 realm.setNonce("fFDVc60re9zt8fFDvht0tNrYuvqrcchN");
             }
         }

client/src/test/java/org/asynchttpclient/DigestAuthTest.java

@@ -48,7 +48,6 @@ public void setUpGlobal() throws Exception {
 
     private static class SimpleHandler extends AbstractHandler {
         public void handle(String s, Request r, HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
-
             response.addHeader("X-Auth", request.getHeader("Authorization"));
             response.setStatus(200);
             response.getOutputStream().flush();