Fix #4997: add null checks for ObjectNode keys

Author: cowtowncoder

release-notes/VERSION-2.x

@@ -60,6 +60,7 @@ Project: jackson-databind
  (fix by Joo-Hyuk K)
 #4963: Serializing `Map.Entry` as Bean with `@JsonFormat.shape = Shape.OBJECT`
   fails on JDK 17+
+#4997: `ObjectNode` put methods should do null check for key
 
 2.18.3 (28-Feb-2025)
 

src/main/java/com/fasterxml/jackson/databind/node/ObjectNode.java

@@ -87,8 +87,7 @@ public ObjectNode with(String exprOrProperty) {
                 .getClass().getName() + "`)");
         }
         ObjectNode result = objectNode();
-        _children.put(exprOrProperty, result);
-        return result;
+        return _put(exprOrProperty, result);
     }
 
     @Override
@@ -132,7 +131,7 @@ public ArrayNode withArray(String exprOrProperty)
                 .getClass().getName() + "`)");
         }
         ArrayNode result = arrayNode();
-        _children.put(exprOrProperty, result);
+        _put(exprOrProperty, result);
         return result;
     }
 
@@ -625,6 +624,9 @@ public <T extends JsonNode> T set(String propertyName, JsonNode value)
      * Method for adding given properties to this object node, overriding
      * any existing values for those properties.
      *<p>
+     * NOTE: {@code null} keys are not allowed; ({@code null} values get
+     * converted to a {@link NullNode}).
+     *<p>
      * NOTE: co-variant return type since 2.10
      *
      * @param properties Properties to add
@@ -641,7 +643,7 @@ public <T extends JsonNode> T setAll(Map<String,? extends JsonNode> properties)
             if (n == null) {
                 n = nullNode();
             }
-            _children.put(en.getKey(), n);
+            _put(en.getKey(), n);
         }
         return (T) this;
     }
@@ -669,7 +671,7 @@ public <T extends JsonNode> T setAll(ObjectNode other)
      * Method for replacing value of specific property with passed
      * value, and returning value (or null if none).
      *
-     * @param propertyName Property of which value to replace
+     * @param propertyName Property of which value to replace: must not be {@code null}
      * @param value Value to set property to, replacing old value if any
      *
      * @return Old value of the property; null if there was no such property
@@ -682,7 +684,7 @@ public JsonNode replace(String propertyName, JsonNode value)
         if (value == null) { // let's not store 'raw' nulls but nodes
             value = nullNode();
         }
-        return _children.put(propertyName, value);
+        return _children.put(Objects.requireNonNull(propertyName), value);
     }
 
     /**
@@ -730,7 +732,7 @@ public <T extends JsonNode> T without(Collection<String> propertyNames)
     /**
      * Method that will set specified property, replacing old value, if any.
      *
-     * @param propertyName Name of property to set
+     * @param propertyName Name of property to set (must not be {@code null})
      * @param value Value to set to property; if null, will be converted
      *   to a {@link NullNode} first  (to remove a property, call
      *   {@link #remove} instead).
@@ -746,7 +748,7 @@ public JsonNode put(String propertyName, JsonNode value)
         if (value == null) { // let's not store 'raw' nulls but nodes
             value = nullNode();
         }
-        return _children.put(propertyName, value);
+        return _children.put(Objects.requireNonNull(propertyName), value);
     }
 
     /**
@@ -763,7 +765,7 @@ public JsonNode put(String propertyName, JsonNode value)
      *  }
      *</code>
      *
-     * @param propertyName Name of property to set
+     * @param propertyName Name of property to set (must not be {@code null})
      * @param value Value to set to property (if and only if it had no value previously);
      *  if null, will be converted to a {@link NullNode} first.
      *
@@ -777,7 +779,7 @@ public JsonNode putIfAbsent(String propertyName, JsonNode value)
         if (value == null) { // let's not store 'raw' nulls but nodes
             value = nullNode();
         }
-        return _children.putIfAbsent(propertyName, value);
+        return _children.putIfAbsent(Objects.requireNonNull(propertyName), value);
     }
 
     /**
@@ -1176,9 +1178,10 @@ public int hashCode()
     /**********************************************************
      */
 
+    // @since 2.19
     protected ObjectNode _put(String propertyName, JsonNode value)
     {
-        _children.put(propertyName, value);
+        _children.put(Objects.requireNonNull(propertyName), value);
         return this;
     }
 }

src/test/java/com/fasterxml/jackson/databind/node/ObjectNodeTest.java

@@ -279,6 +279,23 @@ public void testNullChecking2()
         dest.setAll(src);
     }
 
+    // for [databind#346]
+    @Test
+    public void testNullKeyChecking()
+    {
+        ObjectNode src = MAPPER.createObjectNode();
+        assertThrows(NullPointerException.class, () -> src.put(null, "a"));
+        assertThrows(NullPointerException.class, () -> src.put(null, 123));
+        assertThrows(NullPointerException.class, () -> src.put(null, 123L));
+        assertThrows(NullPointerException.class, () -> src.putNull(null));
+
+        assertThrows(NullPointerException.class, () -> src.set(null, BooleanNode.TRUE));
+        assertThrows(NullPointerException.class, () -> src.replace(null, BooleanNode.TRUE));
+        
+        assertThrows(NullPointerException.class, () -> src.setAll(Collections.singletonMap(null,
+                MAPPER.createArrayNode())));
+    }
+    
     @Test
     public void testRemove()
     {