containerAnalyzer opened a new pull request #491: URL: https://github.com/apache/struts/pull/491
Hello, Our static analyzer found a following potential NPE. We have checked the feasibility of this execution trace. It is necessary to defend this vulnerability to improve the code quality. Here is the bug trace. 1. Return **null** to caller https://github.com/apache/struts/blob/cb318cdc749f40a06eaaeed789a047f385a55480/core/src/main/java/com/opensymphony/xwork2/util/DomHelper.java#L226 2. Function **getDocument** executes and the return value can be **null** https://github.com/apache/struts/blob/cb318cdc749f40a06eaaeed789a047f385a55480/core/src/main/java/com/opensymphony/xwork2/util/DomHelper.java#L123 3. Function **parse** executes and pass the return value as the parameter of **add**, which can be **null** https://github.com/apache/struts/blob/cb318cdc749f40a06eaaeed789a047f385a55480/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlConfigurationProvider.java#L1080 4. Function **add** executes. One of the elements in **docs** can be **null** https://github.com/apache/struts/blob/cb318cdc749f40a06eaaeed789a047f385a55480/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlConfigurationProvider.java#L1080 5. Function **next** executes and stores the return value to **doc** (doc can be null) https://github.com/apache/struts/blob/cb318cdc749f40a06eaaeed789a047f385a55480/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlConfigurationProvider.java#L1108 6. **doc** is passed as the **this** pointer to function **getDocumentElement** (**doc** can be **null**), which will lead to null pointer dereference https://github.com/apache/struts/blob/cb318cdc749f40a06eaaeed789a047f385a55480/core/src/main/java/com/opensymphony/xwork2/config/providers/XmlConfigurationProvider.java#L1109 Commit: cb318cdc749f40a06eaaeed789a047f385a55480 We have fixed this NPE in this PR. Please confirm and merge it to make the code more reliable. Thanks. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@struts.apache.org For additional commands, e-mail: dev-h...@struts.apache.org
