Skip to content

Make application password uuid/name nullable to avoid Gson NPE#22968

Draft
adalpari wants to merge 1 commit into
trunkfrom
fix/application-passwords-gson-npe
Draft

Make application password uuid/name nullable to avoid Gson NPE#22968
adalpari wants to merge 1 commit into
trunkfrom
fix/application-passwords-gson-npe

Conversation

@adalpari

Copy link
Copy Markdown
Contributor

Description

ApplicationPasswordCreationResponse and ApplicationPasswordsFetchResponse are
deserialized by Gson, which populates fields via reflection. When the server omits a
field, Gson assigns null to it even though the Kotlin property is declared non-null —
the violated invariant then surfaces as a latent NullPointerException when the value
is later dereferenced (e.g. it.uuid when building the UUID/creation payloads).

This follows up on a review comment from #22953 (the Site Settings GBKit toggle RC crash
fix), where the same latent issue was flagged but deferred as out of scope for that
targeted RC fix.

Changes (scoped to uuid and name only):

  • Make uuid and name nullable in ApplicationPasswordCreationResponse and
    ApplicationPasswordsFetchResponse.
  • Guard the uuid dereferences in WPApiApplicationPasswordsRestClient (create, fetch,
    and introspect paths) and JetpackApplicationPasswordsRestClient (create and fetch
    paths) so a missing uuid returns the existing error payload instead of crashing.
  • name is only used in null-safe == comparisons, so it needs no usage-site guards.

No behavior change for well-formed responses; only the malformed/missing-field path is
affected, which now degrades gracefully to an error payload.

Testing instructions

This is a defensive fix for malformed server responses that can't easily be reproduced
against a real backend. Verify via code review and existing coverage:

  1. Run the fluxc unit tests:
    ./gradlew :libs:fluxc:testDebugUnitTest --tests "*ApplicationPassword*"
  • Verify application password creation/fetch/delete tests still pass.
  1. Sign in to a self-hosted site using application-password auth and confirm login still
    works end to end.
  • Verify the application password is created and the site connects normally.

🤖 Generated with Claude Code

Gson populates fields via reflection and can assign null to a non-null
Kotlin property when the server omits it, causing a latent NPE when the
value is later dereferenced. Make uuid and name nullable and guard the
uuid usage sites in the WPApi and Jetpack rest clients.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@dangermattic

Copy link
Copy Markdown
Collaborator
1 Message
📖 This PR is still a Draft: some checks will be skipped.

Generated by 🚫 Danger

@wpmobilebot

Copy link
Copy Markdown
Contributor

App Icon📲 You can test the changes from this Pull Request in WordPress Android by scanning the QR code below to install the corresponding build.

App NameWordPress Android
Build TypeDebug
Versionpr22968-feff57e
Build Number1493
Application IDorg.wordpress.android.prealpha
Commitfeff57e
Installation URL7ueotfcjj7u3g
Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

@wpmobilebot

Copy link
Copy Markdown
Contributor

App Icon📲 You can test the changes from this Pull Request in Jetpack Android by scanning the QR code below to install the corresponding build.

App NameJetpack Android
Build TypeDebug
Versionpr22968-feff57e
Build Number1493
Application IDcom.jetpack.android.prealpha
Commitfeff57e
Installation URL5m3g9ucs83oko
Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

@codecov

codecov Bot commented Jun 10, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 16 lines in your changes missing coverage. Please review.
✅ Project coverage is 37.22%. Comparing base (70613b7) to head (feff57e).

Files with missing lines Patch % Lines
...onpasswords/WPApiApplicationPasswordsRestClient.kt 0.00% 7 Missing ⚠️
...passwords/JetpackApplicationPasswordsRestClient.kt 0.00% 5 Missing ⚠️
...ationpasswords/ApplicationPasswordsApiResponses.kt 0.00% 4 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##            trunk   #22968      +/-   ##
==========================================
- Coverage   37.22%   37.22%   -0.01%     
==========================================
  Files        2329     2329              
  Lines      125323   125325       +2     
  Branches    17044    17044              
==========================================
  Hits        46657    46657              
- Misses      74893    74895       +2     
  Partials     3773     3773              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants