Make application password uuid/name nullable to avoid Gson NPE#22968
Draft
adalpari wants to merge 1 commit into
Draft
Make application password uuid/name nullable to avoid Gson NPE#22968adalpari wants to merge 1 commit into
adalpari wants to merge 1 commit into
Conversation
Gson populates fields via reflection and can assign null to a non-null Kotlin property when the server omits it, causing a latent NPE when the value is later dereferenced. Make uuid and name nullable and guard the uuid usage sites in the WPApi and Jetpack rest clients. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator
Generated by 🚫 Danger |
1 task
Contributor
|
|
Contributor
|
|
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## trunk #22968 +/- ##
==========================================
- Coverage 37.22% 37.22% -0.01%
==========================================
Files 2329 2329
Lines 125323 125325 +2
Branches 17044 17044
==========================================
Hits 46657 46657
- Misses 74893 74895 +2
Partials 3773 3773 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.


Description
ApplicationPasswordCreationResponseandApplicationPasswordsFetchResponsearedeserialized by Gson, which populates fields via reflection. When the server omits a
field, Gson assigns
nullto it even though the Kotlin property is declared non-null —the violated invariant then surfaces as a latent
NullPointerExceptionwhen the valueis later dereferenced (e.g.
it.uuidwhen building the UUID/creation payloads).This follows up on a review comment from #22953 (the Site Settings GBKit toggle RC crash
fix), where the same latent issue was flagged but deferred as out of scope for that
targeted RC fix.
Changes (scoped to
uuidandnameonly):uuidandnamenullable inApplicationPasswordCreationResponseandApplicationPasswordsFetchResponse.uuiddereferences inWPApiApplicationPasswordsRestClient(create, fetch,and introspect paths) and
JetpackApplicationPasswordsRestClient(create and fetchpaths) so a missing
uuidreturns the existing error payload instead of crashing.nameis only used in null-safe==comparisons, so it needs no usage-site guards.No behavior change for well-formed responses; only the malformed/missing-field path is
affected, which now degrades gracefully to an error payload.
Testing instructions
This is a defensive fix for malformed server responses that can't easily be reproduced
against a real backend. Verify via code review and existing coverage:
./gradlew :libs:fluxc:testDebugUnitTest --tests "*ApplicationPassword*"works end to end.
🤖 Generated with Claude Code