Describe the bug
java.lang.NullPointerException occurred during analysis of a package-lock.json
Version of dependency-check used
7.0.4
Log file
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARN] The Node Package Analyzer has been disabled; the resulting report will only contain the known vulnerable dependency - not a bill of materials for the node project.
[WARN] An unexpected error occurred during analysis of 'C:\Users\TBATTI~1\AppData\Local\Temp\dctemp39951aff-f90a-4c1e-ab61-f13070969377\check12744923193935695818tmp\1\depcheckFrontend\package-lock.json' (Node Audit Analyzer): Cannot invoke "javax.json.JsonString.getString()" because the return value of "org.glassfish.json.JsonObjectBuilderImpl$JsonObjectImpl.getJsonString(String)" is null
[ERROR]
java.lang.NullPointerException: Cannot invoke "javax.json.JsonString.getString()" because the return value of "org.glassfish.json.JsonObjectBuilderImpl$JsonObjectImpl.getJsonString(String)" is null
at org.glassfish.json.JsonObjectBuilderImpl$JsonObjectImpl.getString(JsonObjectBuilderImpl.java:257)
at org.owasp.dependencycheck.data.nodeaudit.NpmPayloadBuilder.lambda$build$5(NpmPayloadBuilder.java:152)
at java.base/java.util.Collections$UnmodifiableMap$UnmodifiableEntrySet.lambda$entryConsumer$0(Collections.java:1625)
at java.base/java.util.LinkedHashMap$LinkedEntrySet.forEach(LinkedHashMap.java:708)
at java.base/java.util.Collections$UnmodifiableMap$UnmodifiableEntrySet.forEach(Collections.java:1630)
at org.owasp.dependencycheck.data.nodeaudit.NpmPayloadBuilder.build(NpmPayloadBuilder.java:147)
at org.owasp.dependencycheck.analyzer.NodeAuditAnalyzer.legacyAnalysis(NodeAuditAnalyzer.java:249)
at org.owasp.dependencycheck.analyzer.NodeAuditAnalyzer.analyzeDependency(NodeAuditAnalyzer.java:148)
at org.owasp.dependencycheck.analyzer.AbstractAnalyzer.analyze(AbstractAnalyzer.java:131)
at org.owasp.dependencycheck.AnalysisTask.call(AnalysisTask.java:88)
at org.owasp.dependencycheck.AnalysisTask.call(AnalysisTask.java:37)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
at java.base/java.lang.Thread.run(Thread.java:833)
[INFO] Finished Node Audit Analyzer (0 seconds)
[INFO] Finished Sonatype OSS Index Analyzer (0 seconds)
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing report to: C:\Users\tbattisti\Desktop\testDepCheckFE\dependency-check-7.0.4-release\dependency-check\.\dependency-check-report.html
[ERROR] Cannot invoke "javax.json.JsonString.getString()" because the return value of "org.glassfish.json.JsonObjectBuilderImpl$JsonObjectImpl.getJsonString(String)" is null
To Reproduce
Steps to reproduce the behavior:
- Download and unzip dependencyCheck from https://github.com/jeremylong/DependencyCheck/releases/download/v7.0.4/dependency-check-7.0.4-release.zip
- Download attacched package-lock.zip
- Launch command from cmd
bin\dependency-check.bat --disableNodeJS --scan package-lock.zip
- See error
Describe the bug
java.lang.NullPointerException occurred during analysis of a package-lock.json
Version of dependency-check used
7.0.4
Log file
[INFO] Analysis Started [INFO] Finished Archive Analyzer (0 seconds) [INFO] Finished File Name Analyzer (0 seconds) [INFO] Finished Dependency Merging Analyzer (0 seconds) [INFO] Finished Version Filter Analyzer (0 seconds) [INFO] Finished Hint Analyzer (0 seconds) [INFO] Created CPE Index (1 seconds) [INFO] Finished CPE Analyzer (2 seconds) [INFO] Finished False Positive Analyzer (0 seconds) [INFO] Finished NVD CVE Analyzer (0 seconds) [WARN] The Node Package Analyzer has been disabled; the resulting report will only contain the known vulnerable dependency - not a bill of materials for the node project. [WARN] An unexpected error occurred during analysis of 'C:\Users\TBATTI~1\AppData\Local\Temp\dctemp39951aff-f90a-4c1e-ab61-f13070969377\check12744923193935695818tmp\1\depcheckFrontend\package-lock.json' (Node Audit Analyzer): Cannot invoke "javax.json.JsonString.getString()" because the return value of "org.glassfish.json.JsonObjectBuilderImpl$JsonObjectImpl.getJsonString(String)" is null [ERROR] java.lang.NullPointerException: Cannot invoke "javax.json.JsonString.getString()" because the return value of "org.glassfish.json.JsonObjectBuilderImpl$JsonObjectImpl.getJsonString(String)" is null at org.glassfish.json.JsonObjectBuilderImpl$JsonObjectImpl.getString(JsonObjectBuilderImpl.java:257) at org.owasp.dependencycheck.data.nodeaudit.NpmPayloadBuilder.lambda$build$5(NpmPayloadBuilder.java:152) at java.base/java.util.Collections$UnmodifiableMap$UnmodifiableEntrySet.lambda$entryConsumer$0(Collections.java:1625) at java.base/java.util.LinkedHashMap$LinkedEntrySet.forEach(LinkedHashMap.java:708) at java.base/java.util.Collections$UnmodifiableMap$UnmodifiableEntrySet.forEach(Collections.java:1630) at org.owasp.dependencycheck.data.nodeaudit.NpmPayloadBuilder.build(NpmPayloadBuilder.java:147) at org.owasp.dependencycheck.analyzer.NodeAuditAnalyzer.legacyAnalysis(NodeAuditAnalyzer.java:249) at org.owasp.dependencycheck.analyzer.NodeAuditAnalyzer.analyzeDependency(NodeAuditAnalyzer.java:148) at org.owasp.dependencycheck.analyzer.AbstractAnalyzer.analyze(AbstractAnalyzer.java:131) at org.owasp.dependencycheck.AnalysisTask.call(AnalysisTask.java:88) at org.owasp.dependencycheck.AnalysisTask.call(AnalysisTask.java:37) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) at java.base/java.lang.Thread.run(Thread.java:833) [INFO] Finished Node Audit Analyzer (0 seconds) [INFO] Finished Sonatype OSS Index Analyzer (0 seconds) [INFO] Finished Vulnerability Suppression Analyzer (0 seconds) [INFO] Finished Dependency Bundling Analyzer (0 seconds) [INFO] Analysis Complete (2 seconds) [INFO] Writing report to: C:\Users\tbattisti\Desktop\testDepCheckFE\dependency-check-7.0.4-release\dependency-check\.\dependency-check-report.html [ERROR] Cannot invoke "javax.json.JsonString.getString()" because the return value of "org.glassfish.json.JsonObjectBuilderImpl$JsonObjectImpl.getJsonString(String)" is nullTo Reproduce
Steps to reproduce the behavior:
bin\dependency-check.bat --disableNodeJS --scan package-lock.zip