Skip to content

fix: null handling in CLIParser and CombinedCLIParser #4000

@Rohan-Saxena644

Description

@Rohan-Saxena644

Problem

The CLI XML parser layer has several latent null-pointer vulnerabilities
that can cause silent data corruption or NPEs when processing malformed
XML attachments.

CLIParser.java

  • If a <Copyright> node is missing its <Content> child, null is
    silently inserted as a key into the HashMap, which can cause NPEs downstream
  • AssessmentSummary missing/multiple element cases were collapsed into
    a single else branch, making it impossible to distinguish between the
    two scenarios in logs

CombinedCLIParser.java

  • If a copyright node is missing the srcComponent attribute, externalId
    is null and result.get(null) throws an NPE
  • Null contentText values are added to result Sets, polluting downstream data

Fix

PR #3999 addresses all of the above with null guards, split conditionals,
and appropriate log levels.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions