Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-platform Commit: 4c8b39eaf3d88ec45ac883f7b8e96ff0e8d9ba4b https://github.com/xwiki/xwiki-platform/commit/4c8b39eaf3d88ec45ac883f7b8e96... Author: Vincent Massol <[email protected]> Date: 2026-09-10 (Thu, 10 Sep 2026) Changed paths: M xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/pom.xml M xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/main/java/org/xwiki/extension/security/internal/analyzer/osv/OsvResponseAnalyzer.java M xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/main/java/org/xwiki/extension/security/internal/analyzer/osv/model/response/AffectObject.java M xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/main/java/org/xwiki/extension/security/internal/analyzer/osv/model/response/VulnObject.java M xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/test/java/org/xwiki/extension/security/internal/analyzer/osv/OsvResponseAnalyzerTest.java A xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/test/java/org/xwiki/extension/security/internal/analyzer/osv/model/response/AffectObjectTest.java A xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/test/java/org/xwiki/extension/security/internal/analyzer/osv/model/response/VulnObjectTest.java A xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/test/resources/osvResponseWithoutRanges.json A xwiki-platform-core/xwiki-platform-extension/xwiki-platform-extension-security/xwiki-platform-extension-security-index/src/test/resources/osvResponseWithoutRangesPlatform.json Log Message: ----------- [Misc] Fix a NullPointerException when an OSV response omits an optional list field (#5966) * [Misc] Fix a NullPointerException when an OSV response omits an optional list field The "ranges", "affected" and "references" fields are all optional in the OSV schema (an affected entry can enumerate the affected versions instead of declaring ranges, for example), but the response model returned them as-is and the analyzer streamed over them, which failed the analysis of such a vulnerability with: Unexpected error [NullPointerException: Cannot invoke "java.util.List.stream()" because the return value of "...osv.model.response.AffectObject.getRanges()" is null] AffectObject#getRanges(), VulnObject#getAffected() and VulnObject#getReferences() now return an empty list when the field is absent, and the callers inside VulnObject go through the getters rather than the fields. The now-dead emptiness check in OsvResponseAnalyzer#checkRanges goes away. * [Misc] Make the optional OSV list fields never null instead of null-checking the getters Following Simon's review: returning List.of() from the getter when the field is absent made the returned list immutable in that case and mutable (the live internal list) otherwise, and left the field itself null. The ranges, affected and references fields are now initialized to an empty list and the getters are back to returning the field directly. The setters store null as an empty list too, so that an explicit null in the JSON response (which Jackson routes to the setter, bypassing the field initializer) cannot reintroduce the NPE. VulnObject#getAliases() is aligned to the same pattern, replacing its lazy initialization in the getter. Its observable behaviour is unchanged since it was already never returning null. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 5 (1M context) <[email protected]> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications