[Bug] DefaultSecurityManger.login(null, token) fails in 2.2.1

[mnd999]

Search before asking

• I had searched in the issues, including closed issues and found no similar issues.

Environment

We integrate Shiro into our application login, no containers are used. Jdk 21.

Shiro version

2.2.1

What was the actual outcome?

In previous versions, passing a null subject into DefaultSecurityManager.login() would succeed. After #2704 fix (9371115) , this now fails with an NPE:

There is also no javadoc on the subject parameter, so it's not easy to tell if it was supposed to be mandatory or not. It doesn't seem like you should need a subject to login.

java.lang.NullPointerException: Cannot invoke "org.apache.shiro.subject.Subject.getSession(boolean)" because "subject" is null
	at org.apache.shiro.mgt.DefaultSecurityManager.beforeSuccessfulLogin(DefaultSecurityManager.java:308)
	at org.apache.shiro.mgt.DefaultSecurityManager.login(DefaultSecurityManager.java:294)

What was the expected outcome?

A new subject should be created based on the results of the login, as per previous versions.

How to reproduce

As above

Debug logs

No response

[lprimak]

Hi,
The typical use case is to call Subject.login() instead, which doesn't cause this issue.
However, I would agree that this is a minor regression and there is a PR to fix it.