-
Notifications
You must be signed in to change notification settings - Fork 330
Open
Description
Problem
The CLI XML parser layer has several latent null-pointer vulnerabilities
that can cause silent data corruption or NPEs when processing malformed
XML attachments.
CLIParser.java
- If a
<Copyright>node is missing its<Content>child,nullis
silently inserted as a key into the HashMap, which can cause NPEs downstream AssessmentSummarymissing/multiple element cases were collapsed into
a singleelsebranch, making it impossible to distinguish between the
two scenarios in logs
CombinedCLIParser.java
- If a copyright node is missing the
srcComponentattribute,externalId
is null andresult.get(null)throws an NPE - Null
contentTextvalues are added to result Sets, polluting downstream data
Fix
PR #3999 addresses all of the above with null guards, split conditionals,
and appropriate log levels.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels