Protect against null BindHandler.onStart result

Fixes gh-18129

spring-boot-project/spring-boot/src/main/java/org/springframework/boot/context/properties/bind/Binder.java

@@ -285,10 +285,11 @@ public class Binder {
 			boolean allowRecursiveBinding, boolean create) {
 		context.clearConfigurationProperty();
 		try {
-			target = handler.onStart(name, target, context);
+			Bindable<T> replacementTarget = handler.onStart(name, target, context);
-			if (target == null) {
+			if (replacementTarget == null) {
 				return handleBindResult(name, target, handler, context, null, create);
 			}
+			target = replacementTarget;
 			Object bound = bindObject(name, target, handler, context, allowRecursiveBinding);
 			return handleBindResult(name, target, handler, context, bound, create);
 		}

spring-boot-project/spring-boot/src/test/java/org/springframework/boot/context/properties/bind/BinderTests.java

@@ -318,6 +318,20 @@ class BinderTests {
 		assertThat(value).isInstanceOf(JavaBean.class);
 	}
 
+	@Test
+	void bindToJavaBeanWhenHandlerOnStartReturnsNullShouldReturnUnbound() { // gh-18129
+		this.sources.add(new MockConfigurationPropertySource("foo.value", "bar"));
+		BindResult<JavaBean> result = this.binder.bind("foo", Bindable.of(JavaBean.class), new BindHandler() {
+
+			@Override
+			public <T> Bindable<T> onStart(ConfigurationPropertyName name, Bindable<T> target, BindContext context) {
+				return null;
+			}
+
+		});
+		assertThat(result.isBound()).isFalse();
+	}
+
 	static class JavaBean {
 
 		private String value;