[Bug]: Missing null check in `AnnotationsUtils.setDefaultSchema()`

[cooltea713705]

Description of the problem/issue

• Affected version: swagger-core-jakarta 2.2.44
• Works in: 2.2.43
• Root cause: Schema.defaultValue() annotation attribute default changed from "" to "##default" in 2.2.44, but setDefaultSchema() has no null guard. When annotations compiled against 2.2.43 are synthesized at runtime via Spring MergedAnnotations, defaultValue() can return null instead of the new sentinel, bypassing the !DEFAULT_SENTINEL.equals(schema.defaultValue()) guard and causing NPE at line 931 in AnnotationUtils.

// Current (buggy):
String defaultValue = schema.defaultValue().trim();

// Fix:
String rawDefault = schema.defaultValue();
if (rawDefault == null) return;
String defaultValue = rawDefault.trim();

• Trigger: Any @Parameter with array = @ArraySchema(...) on a method compiled against 2.2.43 annotations, processed by springdoc 2.8.x at runtime
• Workaround: Keep swagger-annotations-jakarta aligned with what springdoc manages (2.2.43)

Steps to Reproduce

1. Have a multi-module Maven project where module A (a library) is compiled against swagger-annotations-jakarta 2.2.43 and defines a method parameter annotated with @Parameter(array = @ArraySchema(schema = @Schema(...))) — either directly or via a meta-annotation.
2. Module B (the application) depends on module A and on springdoc-openapi-starter-webmvc-ui 2.8.x, which transitively pulls in swagger-core-jakarta 2.2.44 (e.g. by overriding the
   version springdoc manages).
3. Start the Spring Boot application and call the /v3/api-docs or /v3/api-docs.yaml endpoint.

Expected Behavior

The OpenAPI documentation endpoint returns 200 OK with a valid schema.

Actual Behavior

The endpoint returns 500 Internal Server Error. The following exception is thrown during schema generation:

  java.lang.NullPointerException: Cannot invoke "String.trim()" because the return value of "io.swagger.v3.oas.annotations.media.Schema.defaultValue()" is null
      at io.swagger.v3.core.util.AnnotationsUtils.setDefaultSchema(AnnotationsUtils.java:931)
      at io.swagger.v3.core.util.AnnotationsUtils.getSchemaFromAnnotation(AnnotationsUtils.java:784)
      at io.swagger.v3.core.util.AnnotationsUtils.getSchemaFromAnnotation(AnnotationsUtils.java:623)
      at io.swagger.v3.core.util.AnnotationsUtils.getSchemaFromAnnotation(AnnotationsUtils.java:614)
      at io.swagger.v3.core.util.AnnotationsUtils.getSchemaFromAnnotation(AnnotationsUtils.java:606)
      at io.swagger.v3.core.util.AnnotationsUtils.getSchema(AnnotationsUtils.java:1877)
      at org.springdoc.core.service.GenericParameterService.setSchema(GenericParameterService.java:358)
      at org.springdoc.core.service.GenericParameterService.buildParameterFromDoc(GenericParameterService.java:310)
      at org.springdoc.core.service.AbstractRequestService.build(AbstractRequestService.java:342)
      at org.springdoc.api.AbstractOpenApiResource.calculatePath(AbstractOpenApiResource.java:636)

Logs / Stack Traces

See above.

Additional Context

• springdoc-openapi 2.8.16 manages swagger-core-jakarta at 2.2.43 (declared as swagger-api.version in its parent BOM). If a downstream project or library overrides this to 2.2.44 —
  even just for swagger-annotations-jakarta — the mismatch triggers the NPE.
• The call path that hits the bug is in GenericParameterService.setSchema() (springdoc 2.8.16, line 358): when schema == null and parameterDoc.array() != null, springdoc calls
  AnnotationsUtils.getSchema(parameterDoc.schema(), parameterDoc.array(), true, ...). The parameterDoc.schema() here is the default @Schema() nested inside @Parameter. When Spring
  synthesizes this annotation from a class compiled against 2.2.43, defaultValue() returns null rather than "##default", bypassing the DEFAULT_SENTINEL guard introduced in 2.2.44.
• Related to: [Bug]: Another ##default leaks case (version 2.2.44 and 2.2.45): @Parameter + @ArraySchema #5086

Checklist

• I have searched the existing issues and this is not a duplicate.
• I have provided sufficient information for maintainers to reproduce the issue.

[Mattias-Sehlstedt]

I have a fix coming later in springdoc with springdoc/springdoc-openapi#3245 too, but there I cannot promise when it will be available since it varies a lot how often the maintainer handles PR:s.

[cooltea713705]

Thank you for the reply and the fix in springdoc!
I was aware of the issue reported in #5086 and am happy that the springdoc update is taken care of in springdoc/springdoc-openapi#3245.
I still wanted to report this issue for people having a misalignment in their swagger-core-jakarta and swagger-annotations-jakarta version since the null check is necessary then (not necessarily tied to springdoc): the null check could just be added to swagger-core, couldn't it?

[Mattias-Sehlstedt]

I have made a PR for it as well in this repo, see #5089.

[ewaostrowska]

Thanks to @Mattias-Sehlstedt PR the issue should be fixed after the next release :)