Align Null Behavior

Previously, ExternalInetAddressMatcher treated a null InetAddress
as external by negating InternalInetAddressMatcher's result.

This commit makes ExternalInetAddressMatcher return false for a
null address, so that neither the internal nor the external
matcher classifies an unknown address as a match.

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>

core/src/main/java/org/springframework/security/util/matcher/InetAddressMatchers.java

@@ -335,6 +335,9 @@ public final class InetAddressMatchers {
 
 		@Override
 		public boolean matches(@Nullable InetAddress address) {
+			if (address == null) {
+				return false;
+			}
 			return !this.internalMatcher.matches(address);
 		}
 

core/src/test/java/org/springframework/security/util/matcher/InetAddressMatchersTests.java

@@ -415,6 +415,12 @@ class InetAddressMatchersTests {
 	@Nested
 	class ExternalInetAddressMatcherTests {
 
+		@Test
+		void matchesWhenInetAddressNullThenReturnsFalse() {
+			InetAddressMatcher matcher = InetAddressMatchers.matchExternal().build();
+			assertThat(matcher.matches((InetAddress) null)).isFalse();
+		}
+
 		@ParameterizedTest
 		@ValueSource(strings = { "8.8.8.8", "1.1.1.1" })
 		void matchesWhenIpv4PublicThenReturnsTrue(String address) throws Exception {