Fix NPE when nameAttributeValue is null #15338

- fix name attribute value check method
- add test case when nameAttributeValue is null

Author: HyoJongPark

oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/user/DefaultOAuth2User.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2021 the original author or authors.
+ * Copyright 2002-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -44,6 +44,7 @@
  *
  * @author Joe Grandja
  * @author Eddú Meléndez
+ * @author Park Hyojong
  * @since 5.0
  * @see OAuth2User
  */
@@ -69,8 +70,10 @@ public DefaultOAuth2User(Collection<? extends GrantedAuthority> authorities, Map
 		Assert.notEmpty(attributes, "attributes cannot be empty");
 		Assert.hasText(nameAttributeKey, "nameAttributeKey cannot be empty");
 		if (!attributes.containsKey(nameAttributeKey)) {
-			throw new IllegalArgumentException("Missing attribute '" + nameAttributeKey + "' in attributes");
+			throw new IllegalArgumentException("Missing nameAttributeKey '" + nameAttributeKey + "' in attributes");
 		}
+		Assert.notNull(attributes.get(nameAttributeKey), "Name attribute '" + nameAttributeKey + "' cannot be null");
+
 		this.authorities = (authorities != null)
 				? Collections.unmodifiableSet(new LinkedHashSet<>(this.sortAuthorities(authorities)))
 				: Collections.unmodifiableSet(new LinkedHashSet<>(AuthorityUtils.NO_AUTHORITIES));

oauth2/oauth2-core/src/test/java/org/springframework/security/oauth2/core/user/DefaultOAuth2UserTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2021 the original author or authors.
+ * Copyright 2002-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -34,6 +34,7 @@
  *
  * @author Vedran Pavic
  * @author Joe Grandja
+ * @author Park Hyojong
  */
 public class DefaultOAuth2UserTests {
 
@@ -59,6 +60,12 @@ public void constructorWhenAttributesIsEmptyThenThrowIllegalArgumentException()
 			.isThrownBy(() -> new DefaultOAuth2User(AUTHORITIES, Collections.emptyMap(), ATTRIBUTE_NAME_KEY));
 	}
 
+	@Test
+	public void constructorWhenAttributeValueIsNullThenThrowIllegalArgumentException() {
+		assertThatIllegalArgumentException()
+				.isThrownBy(() -> new DefaultOAuth2User(AUTHORITIES, Collections.singletonMap(ATTRIBUTE_NAME_KEY, null), ATTRIBUTE_NAME_KEY));
+	}
+
 	@Test
 	public void constructorWhenNameAttributeKeyIsNullThenThrowIllegalArgumentException() {
 		assertThatIllegalArgumentException().isThrownBy(() -> new DefaultOAuth2User(AUTHORITIES, ATTRIBUTES, null));