Skip to content

[credential-helper] Ignore null values in JSON response - #30874

Closed
Yannic wants to merge 1 commit into
bazelbuild:masterfrom
EngFlow:yannic-cred-helper-nullness
Closed

[credential-helper] Ignore null values in JSON response#30874
Yannic wants to merge 1 commit into
bazelbuild:masterfrom
EngFlow:yannic-cred-helper-nullness

Conversation

@Yannic

@Yannic Yannic commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

This protects against GetCredentialsResponses of the form {"expires": null} or {"headers": null}.

Seen in the wild:

Caused by: com.google.devtools.build.lib.authandtls.credentialhelper.CredentialHelperException: Failed to get credentials for '<redacted>' from helper '<redacted>': error parsing output. stderr:
	at com.google.devtools.build.lib.authandtls.credentialhelper.CredentialHelper.getCredentials(CredentialHelper.java:147)
	at com.google.devtools.build.lib.authandtls.credentialhelper.CredentialHelperCredentials.getCredentialsFromHelper(CredentialHelperCredentials.java:94)
	at com.github.benmanes.caffeine.cache.BoundedLocalCache.lambda$doComputeIfAbsent$14(BoundedLocalCache.java:2688)
	at java.base/java.util.concurrent.ConcurrentHashMap.compute(Unknown Source)
	at com.github.benmanes.caffeine.cache.BoundedLocalCache.doComputeIfAbsent(BoundedLocalCache.java:2686)
	at com.github.benmanes.caffeine.cache.BoundedLocalCache.computeIfAbsent(BoundedLocalCache.java:2669)
	at com.github.benmanes.caffeine.cache.LocalCache.computeIfAbsent(LocalCache.java:112)
	at com.github.benmanes.caffeine.cache.LocalManualCache.get(LocalManualCache.java:62)
	at com.google.devtools.build.lib.authandtls.credentialhelper.CredentialHelperCredentials.getRequestMetadata(CredentialHelperCredentials.java:66)
	at com.google.auth.Credentials.blockingGetToCallback(Credentials.java:128)
	at com.google.auth.Credentials$1.run(Credentials.java:114)
	... 3 more
Caused by: com.google.gson.JsonSyntaxException: Expected value of 'expires' to be a string, got NULL
	at com.google.devtools.build.lib.authandtls.credentialhelper.GetCredentialsResponse$GsonTypeAdapter.read(GetCredentialsResponse.java:178)
	at com.google.devtools.build.lib.authandtls.credentialhelper.GetCredentialsResponse$GsonTypeAdapter.read(GetCredentialsResponse.java:85)
	at com.google.gson.TypeAdapter$1.read(TypeAdapter.java:308)
	at com.google.gson.Gson.fromJson(Gson.java:1361)
	at com.google.gson.Gson.fromJson(Gson.java:1262)
	at com.google.gson.Gson.fromJson(Gson.java:1199)
	at com.google.devtools.build.lib.authandtls.credentialhelper.CredentialHelper.getCredentials(CredentialHelper.java:133)
	... 13 more

RELNOTES: credential-helper: treat null values in response as unset.

This protects against `GetCredentialsResponse`s of the form `{"expires": null}`.

See in the wild:
```
Caused by: com.google.devtools.build.lib.authandtls.credentialhelper.CredentialHelperException: Failed to get credentials for '<redacted>' from helper '<redacted>': error parsing output. stderr:
	at com.google.devtools.build.lib.authandtls.credentialhelper.CredentialHelper.getCredentials(CredentialHelper.java:147)
	at com.google.devtools.build.lib.authandtls.credentialhelper.CredentialHelperCredentials.getCredentialsFromHelper(CredentialHelperCredentials.java:94)
	at com.github.benmanes.caffeine.cache.BoundedLocalCache.lambda$doComputeIfAbsent$14(BoundedLocalCache.java:2688)
	at java.base/java.util.concurrent.ConcurrentHashMap.compute(Unknown Source)
	at com.github.benmanes.caffeine.cache.BoundedLocalCache.doComputeIfAbsent(BoundedLocalCache.java:2686)
	at com.github.benmanes.caffeine.cache.BoundedLocalCache.computeIfAbsent(BoundedLocalCache.java:2669)
	at com.github.benmanes.caffeine.cache.LocalCache.computeIfAbsent(LocalCache.java:112)
	at com.github.benmanes.caffeine.cache.LocalManualCache.get(LocalManualCache.java:62)
	at com.google.devtools.build.lib.authandtls.credentialhelper.CredentialHelperCredentials.getRequestMetadata(CredentialHelperCredentials.java:66)
	at com.google.auth.Credentials.blockingGetToCallback(Credentials.java:128)
	at com.google.auth.Credentials$1.run(Credentials.java:114)
	... 3 more
Caused by: com.google.gson.JsonSyntaxException: Expected value of 'expires' to be a string, got NULL
	at com.google.devtools.build.lib.authandtls.credentialhelper.GetCredentialsResponse$GsonTypeAdapter.read(GetCredentialsResponse.java:178)
	at com.google.devtools.build.lib.authandtls.credentialhelper.GetCredentialsResponse$GsonTypeAdapter.read(GetCredentialsResponse.java:85)
	at com.google.gson.TypeAdapter$1.read(TypeAdapter.java:308)
	at com.google.gson.Gson.fromJson(Gson.java:1361)
	at com.google.gson.Gson.fromJson(Gson.java:1262)
	at com.google.gson.Gson.fromJson(Gson.java:1199)
	at com.google.devtools.build.lib.authandtls.credentialhelper.CredentialHelper.getCredentials(CredentialHelper.java:133)
	... 13 more
```
@github-actions github-actions Bot added the awaiting-review PR is awaiting review from an assigned reviewer label Aug 26, 2026
@meisterT
meisterT requested a review from tjgq August 26, 2026 16:12
@iancha1992 iancha1992 added the team-Remote-Exec Issues and PRs for the Execution (Remote) team label Aug 26, 2026
@github-actions github-actions Bot added the community-reviewed Reviewed by a trusted community contributor label Aug 26, 2026
@tjgq tjgq added awaiting-PR-merge PR has been approved by a reviewer and is ready to be merge internally and removed awaiting-review PR is awaiting review from an assigned reviewer labels Sep 1, 2026
@copybara-service copybara-service Bot closed this in cdf4155 Sep 2, 2026
@github-actions github-actions Bot removed the awaiting-PR-merge PR has been approved by a reviewer and is ready to be merge internally label Sep 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

community-reviewed Reviewed by a trusted community contributor team-Remote-Exec Issues and PRs for the Execution (Remote) team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants