From f6a3f34886f32f98886bca6d78d4cbe151fa3d3e Mon Sep 17 00:00:00 2001
From: Elliotte Rusty Harold <elharo@ibiblio.org>
Date: Thu, 2 Jul 2026 16:51:00 +0000
Subject: [PATCH] fix: throw NullPointerException when getManifest is called
 without Session and classpath is enabled

The two-parameter getManifest(Project, ManifestConfiguration) passes null
for Session. When addClasspath is enabled, doGetManifest dereferences the
null session, causing a NullPointerException.

Add a null check that throws an informative NullPointerException telling
callers to use the three-parameter overload with a non-null Session.

Fixes #364
---
 .../apache/maven/shared/archiver/MavenArchiver.java  |  4 ++++
 .../maven/shared/archiver/MavenArchiverTest.java     | 12 ++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/src/main/java/org/apache/maven/shared/archiver/MavenArchiver.java b/src/main/java/org/apache/maven/shared/archiver/MavenArchiver.java
index fe7429a..a581d91 100644
--- a/src/main/java/org/apache/maven/shared/archiver/MavenArchiver.java
+++ b/src/main/java/org/apache/maven/shared/archiver/MavenArchiver.java
@@ -254,6 +254,10 @@ protected Manifest doGetManifest(
 
         DependencyResolverResult result;
         if (config.isAddClasspath()) {
+            if (session == null) {
+                throw new NullPointerException("Session is required when addClasspath is enabled. "
+                        + "Use getManifest(Session, Project, ManifestConfiguration) instead.");
+            }
             result = session.getService(DependencyResolver.class).resolve(session, project, PathScope.MAIN_RUNTIME);
         } else {
             result = null;
diff --git a/src/test/java/org/apache/maven/shared/archiver/MavenArchiverTest.java b/src/test/java/org/apache/maven/shared/archiver/MavenArchiverTest.java
index 7264763..cd52013 100644
--- a/src/test/java/org/apache/maven/shared/archiver/MavenArchiverTest.java
+++ b/src/test/java/org/apache/maven/shared/archiver/MavenArchiverTest.java
@@ -98,6 +98,18 @@ void setup() {
         when(dependencyResolverResult.getDependencies()).thenReturn(dependencies);
     }
 
+    @Test
+    void getManifestWithoutSessionWhenAddClasspath() {
+        MavenArchiver archiver = new MavenArchiver();
+        Project project = getDummyProject();
+        ManifestConfiguration config = new ManifestConfiguration();
+        config.setAddClasspath(true);
+
+        assertThatExceptionOfType(NullPointerException.class)
+                .isThrownBy(() -> archiver.getManifest(project, config))
+                .withMessageContaining("Session");
+    }
+
     @ParameterizedTest
     @EmptySource
     @ValueSource(