search

fortify / FortifyVulnerabilityExporter

Export Fortify vulnerability data to GitHub, GitLab, SonarQube and more
Other
24 stars 8 forks source link

NullPointerException if output file is specified without parent path #33

Open rsenden opened 2 years ago

rsenden commented 2 years ago 
Caused by: java.lang.NullPointerException
    at com.fortify.vulnexport.spi.target.vuln.consumer.to.file.stream.MultiOutputStreamFactory$MultiOutputStream.createFileOutputStream(MultiOutputStreamFactory.java:88)
    at com.fortify.vulnexport.spi.target.vuln.consumer.to.file.stream.MultiOutputStreamFactory$MultiOutputStream.<init>(MultiOutputStreamFactory.java:79)
    at com.fortify.vulnexport.spi.target.vuln.consumer.to.file.stream.MultiOutputStreamFactory.createOutputStream(MultiOutputStreamFactory.java:53)

It seems like file.getParentFile() at https://github.com/fortify/FortifyVulnerabilityExporter/blob/4d8e14b70e7c93e8464607f569803fe27849402b/FortifyVulnerabilityExporter-spi-to/src/main/java/com/fortify/vulnexport/spi/target/vuln/consumer/to/file/stream/MultiOutputStreamFactory.java#L87 may return null if a user specifies a simple file name (rather than fully qualified file path) as the output file. This causes an NPE in the next line when checking for directory existence: https://github.com/fortify/FortifyVulnerabilityExporter/blob/4d8e14b70e7c93e8464607f569803fe27849402b/FortifyVulnerabilityExporter-spi-to/src/main/java/com/fortify/vulnexport/spi/target/vuln/consumer/to/file/stream/MultiOutputStreamFactory.java#L88