From 25c71e28a8a48458885f27a0c6efa399c01590ef Mon Sep 17 00:00:00 2001
From: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
Date: Tue, 8 Sep 2026 12:35:18 -0600
Subject: [PATCH] Skip Null List Elements When Mapping CAS Attributes To
 Authorities

The io.spring.nullability plugin 0.0.16 upgrade tightens NullAway
analysis and flags list elements from the unannotated, raw
List<?> attribute value as possibly null. A null element has no
value to contribute to an authority, consistent with how a null
attribute value as a whole is already skipped.

See gh-19670

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
---
 ...tedAuthorityFromAssertionAttributesUserDetailsService.java | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/cas/src/main/java/org/springframework/security/cas/userdetails/GrantedAuthorityFromAssertionAttributesUserDetailsService.java b/cas/src/main/java/org/springframework/security/cas/userdetails/GrantedAuthorityFromAssertionAttributesUserDetailsService.java
index 517120aa46..720fef5df6 100644
--- a/cas/src/main/java/org/springframework/security/cas/userdetails/GrantedAuthorityFromAssertionAttributesUserDetailsService.java
+++ b/cas/src/main/java/org/springframework/security/cas/userdetails/GrantedAuthorityFromAssertionAttributesUserDetailsService.java
@@ -61,7 +61,9 @@ public final class GrantedAuthorityFromAssertionAttributesUserDetailsService
 			if (value != null) {
 				if (value instanceof List) {
 					for (Object o : (List<?>) value) {
-						grantedAuthorities.add(createSimpleGrantedAuthority(o));
+						if (o != null) {
+							grantedAuthorities.add(createSimpleGrantedAuthority(o));
+						}
 					}
 				}
 				else {