Harden candidate checks in bean context

Add defensive null handling and stricter filtering in `ConfigurationPropertiesBeanContext`: `isCandidateProperty` now rejects null descriptors and properties without a read method, and `isCandidateClass` now rejects null classes. Tests were updated to cover these edge cases and verify expected behavior for primitives, wrappers, enums, JDK types, and valid configuration properties.

Author: mercyblitz

microsphere-spring-boot-core/src/main/java/io/microsphere/spring/boot/context/properties/bind/ConfigurationPropertiesBeanContext.java

@@ -544,8 +544,14 @@ static String buildPropertyPath(String propertyName, @Nullable String nestedPath
      * @return {@code true} if the property is a binding candidate, {@code false} otherwise
      */
     static boolean isCandidateProperty(PropertyDescriptor descriptor) {
+        if (descriptor == null) {
+            return false;
+        }
         Method readMethod = descriptor.getReadMethod();
-        return readMethod == null || !Object.class.equals(readMethod.getDeclaringClass());
+        if (readMethod == null) {
+            return false;
+        }
+        return !Object.class.equals(readMethod.getDeclaringClass());
     }
 
     /**
@@ -563,6 +569,9 @@ static boolean isCandidateProperty(PropertyDescriptor descriptor) {
      * @return {@code true} if the class is a binding candidate, {@code false} otherwise
      */
     static boolean isCandidateClass(Class<?> beanClass) {
+        if (beanClass == null) {
+            return false;
+        }
         if (isPrimitiveOrWrapper(beanClass) || beanClass.isEnum()) {
             return false;
         }

microsphere-spring-boot-core/src/main/java/io/microsphere/spring/boot/context/properties/bind/EventPublishingConfigurationPropertiesBeanPropertyChangedListener.java

@@ -50,8 +50,7 @@
  * @see ConfigurationPropertiesBeanPropertyChangedEvent
  * @since 1.0.0
  */
-public class EventPublishingConfigurationPropertiesBeanPropertyChangedListener implements BindListener,
-        ApplicationContextAware, InitializingBean, SmartInitializingSingleton {
+public class EventPublishingConfigurationPropertiesBeanPropertyChangedListener implements BindListener, ApplicationContextAware, InitializingBean, SmartInitializingSingleton {
 
     private static final Logger logger = getLogger(EventPublishingConfigurationPropertiesBeanPropertyChangedListener.class);
 
@@ -190,4 +189,4 @@ public void afterSingletonsInstantiated() {
     public boolean isBound() {
         return bound;
     }
-}
+}

microsphere-spring-boot-core/src/test/java/io/microsphere/spring/boot/context/properties/bind/ConfigurationPropertiesBeanContextTest.java

@@ -31,8 +31,10 @@
 import org.springframework.core.annotation.AnnotationAttributes;
 
 import java.beans.PropertyDescriptor;
+import java.util.concurrent.TimeUnit;
 
 import static io.microsphere.spring.boot.context.properties.bind.ConfigurationPropertiesBeanContext.getInstance;
+import static io.microsphere.spring.boot.context.properties.bind.ConfigurationPropertiesBeanContext.isCandidateClass;
 import static io.microsphere.spring.boot.context.properties.bind.ConfigurationPropertiesBeanContext.isCandidateProperty;
 import static io.microsphere.spring.core.annotation.AnnotationUtils.getAnnotationAttributes;
 import static org.junit.jupiter.api.Assertions.assertEquals;
@@ -144,11 +146,33 @@ void testGetInstance() {
 
     @Test
     void testIsCandidateProperty() {
+        assertFalse(isCandidateProperty(null));
         PropertyDescriptor descriptor = getPropertyDescriptor(ConfigurationPropertiesBeanContextTest.class, "name");
-        assertTrue(isCandidateProperty(descriptor));
+        assertFalse(isCandidateProperty(descriptor));
+
+        descriptor = getPropertyDescriptor(ConfigurationPropertiesBeanContextTest.class, "not-found");
+        assertFalse(isCandidateProperty(descriptor));
 
         descriptor = getPropertyDescriptor(ConfigurationPropertiesBeanContextTest.class, "class");
         assertFalse(isCandidateProperty(descriptor));
+
+        descriptor = getPropertyDescriptor(ServerProperties.class, "port");
+        assertTrue(isCandidateProperty(descriptor));
+    }
+
+    @Test
+    void testIsCandidateClass() {
+        // null
+        assertFalse(isCandidateClass(null));
+        // primitive type and wrapper type are not candidate class
+        assertFalse(isCandidateClass(int.class));
+        assertFalse(isCandidateClass(Integer.class));
+        // enumeration type
+        assertFalse(isCandidateClass(TimeUnit.class));
+        // String is candidate class,but is under java.lang package.
+        assertFalse(isCandidateClass(String.class));
+        // current class
+        assertTrue(isCandidateClass(getClass()));
     }
 
     public void setName(String name) {