Branch: refs/heads/misc-osv-optional-list-fields Home: https://github.com/xwiki/xwiki-platform Commit: 7ac736357295b7d00878b8a757ee449b34b7013c https://github.com/xwiki/xwiki-platform/commit/7ac736357295b7d00878b8a757ee4... Author: Vincent Massol <[email protected]> Date: 2026-07-25 (Sat, 25 Jul 2026) Changed paths: M xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/pom.xml M xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/main/java/org/xwiki/extension/security/internal/analyzer/osv/OsvResponseAnalyzer.java M xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/main/java/org/xwiki/extension/security/internal/analyzer/osv/model/response/AffectObject.java M xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/main/java/org/xwiki/extension/security/internal/analyzer/osv/model/response/VulnObject.java M xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/test/java/org/xwiki/extension/security/internal/analyzer/osv/OsvResponseAnalyzerTest.java A xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/test/java/org/xwiki/extension/security/internal/analyzer/osv/model/response/AffectObjectTest.java A xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/test/java/org/xwiki/extension/security/internal/analyzer/osv/model/response/VulnObjectTest.java A xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/test/resources/osvResponseWithoutRanges.json A xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/test/resources/osvResponseWithoutRangesPlatform.json Log Message: ----------- [Misc] Fix a NullPointerException when an OSV response omits an optional list field The "ranges", "affected" and "references" fields are all optional in the OSV schema (an affected entry can enumerate the affected versions instead of declaring ranges, for example), but the response model returned them as-is and the analyzer streamed over them, which failed the analysis of such a vulnerability with: Unexpected error [NullPointerException: Cannot invoke "java.util.List.stream()" because the return value of "...osv.model.response.AffectObject.getRanges()" is null] AffectObject#getRanges(), VulnObject#getAffected() and VulnObject#getReferences() now return an empty list when the field is absent, and the callers inside VulnObject go through the getters rather than the fields. The now-dead emptiness check in OsvResponseAnalyzer#checkRanges goes away. To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications