NullPointerException during dependency analysis

[mum-viadee]

Everytime I try to analyse a project containing an angular 5 frontend and a java 8 backend I get a NPE.

Logfile from Jenkins pipleline

[Pipeline] dependencyCheckAnalyzer
[DependencyCheck] OWASP Dependency-Check Plugin v4.0.0
[DependencyCheck] Executing Dependency-Check with the following options:
[DependencyCheck] -name = VAWL_Internet_Rentenrechner
[DependencyCheck] -scanPath = /data/jenkins-home/workspace/*******************************
[DependencyCheck] -outputDirectory = /data/jenkins-home/workspace/*******************************
[DependencyCheck] -dataDirectory = /data/jenkins-settings/owasp/nvd
[DependencyCheck] -suppressionFile = /data/jenkins-home/workspace/******************************* /dependency-check-suppression.xml
[DependencyCheck] -dataMirroringType = none
[DependencyCheck] -isQuickQueryTimestampEnabled = true
[DependencyCheck] -jarAnalyzerEnabled = true
[DependencyCheck] -nodePackageAnalyzerEnabled = true
[DependencyCheck] -nodeAuditAnalyzerEnabled = true
[DependencyCheck] -retireJsAnalyzerEnabled = true
[DependencyCheck] -composerLockAnalyzerEnabled = true
[DependencyCheck] -pythonDistributionAnalyzerEnabled = true
[DependencyCheck] -pythonPackageAnalyzerEnabled = true
[DependencyCheck] -rubyBundlerAuditAnalyzerEnabled = true
[DependencyCheck] -rubyGemAnalyzerEnabled = true
[DependencyCheck] -cocoaPodsAnalyzerEnabled = true
[DependencyCheck] -swiftPackageManagerAnalyzerEnabled = true
[DependencyCheck] -archiveAnalyzerEnabled = true
[DependencyCheck] -assemblyAnalyzerEnabled = true
[DependencyCheck] -msBuildProjectAnalyzerEnabled = true
[DependencyCheck] -nuGetConfigAnalyzerEnabled = true
[DependencyCheck] -nuspecAnalyzerEnabled = true
[DependencyCheck] -centralAnalyzerEnabled = true
[DependencyCheck] -nexusAnalyzerEnabled = false
[DependencyCheck] -artifactoryAnalyzerEnabled = false
[DependencyCheck] -autoconfAnalyzerEnabled = true
[DependencyCheck] -cmakeAnalyzerEnabled = true
[DependencyCheck] -opensslAnalyzerEnabled = true
[DependencyCheck] -showEvidence = true
[DependencyCheck] -formats = XML
[DependencyCheck] -autoUpdate = false
[DependencyCheck] -updateOnly = false
[DependencyCheck] Scanning: /data/jenkins-home/workspace/*******************************
[DependencyCheck] Analyzing Dependencies
[DependencyCheck] One or more exceptions were thrown while executing Dependency-Check
[DependencyCheck] Exception Caught: java.lang.NullPointerException
[DependencyCheck] Message: null
[DependencyCheck] java.lang.NullPointerException
[DependencyCheck] at org.glassfish.json.JsonObjectBuilderImpl$JsonObjectImpl.getString(JsonObjectBuilderImpl.java:199)
[DependencyCheck] at org.owasp.dependencycheck.data.nodeaudit.SanitizePackage.sanitize(SanitizePackage.java:53)
[DependencyCheck] at org.owasp.dependencycheck.analyzer.NodeAuditAnalyzer.analyzeDependency(NodeAuditAnalyzer.java:176)
[DependencyCheck] at org.owasp.dependencycheck.analyzer.AbstractAnalyzer.analyze(AbstractAnalyzer.java:136)
[DependencyCheck] at org.owasp.dependencycheck.AnalysisTask.call(AnalysisTask.java:88)
[DependencyCheck] at org.owasp.dependencycheck.AnalysisTask.call(AnalysisTask.java:37)
[DependencyCheck] at java.util.concurrent.FutureTask.run(FutureTask.java:266)
[DependencyCheck] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
[DependencyCheck] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
[DependencyCheck] at java.lang.Thread.run(Thread.java:748)
[DependencyCheck]
[Pipeline] }

[mum-viadee]

Looks like this bug is related to #1577 but the NPE is thrown one line before.

[stevespringett]

Does the package.json file you're analyzing not have a version number?

[mum-viadee]

The package.json file has a name and a version:

{
"name": "********************",
"version": "0.0.0",
"license": "MIT",
"scripts": {
"ng": "ng",
"start": "ng serve --proxy-config proxy.conf.json",
"build": "ng build --prod --build-optimizer --subresource-integrity",
"test": "ng test",
"lint": "ng lint",
"e2e": "ng e2e"
},
"private": true,
"dependencies": {
"@angular/animations": "5.2.1",
"@angular/cdk": "5.1.0",
"@angular/common": "5.2.1",
"@angular/compiler": "5.2.1",
"@angular/core": "5.2.1",
"@angular/flex-layout": "5.0.0-beta.13",
"@angular/forms": "5.2.1",
"@angular/http": "5.2.1",
"@angular/material": "5.1.0",
"@angular/material-moment-adapter": "5.1.0",
"@angular/platform-browser": "5.2.1",
"@angular/platform-browser-dynamic": "5.2.1",
"@angular/router": "5.2.1",
"ajv": "6.2.1",
"bowser": "1.9.2",
"core-js": "2.4.1",
"file-saver": "^1.3.8",
"hammerjs": "2.0.8",
"moment": "2.20.1",
"normalize.css": "7.0.0",
"rxjs": "5.5.6",
"web-animations-js": "2.3.1",
"zone.js": "0.8.19"
},
"devDependencies": {
"@angular/cli": "^1.6.8",
"@angular/compiler-cli": "5.2.1",
"@angular/language-service": "5.2.1",
"@types/jasmine": "~2.8.3",
"@types/jasminewd2": "~2.0.2",
"@types/node": "^6.0.100",
"codelyzer": "^4.0.1",
"jasmine-core": "~2.9.0",
"jasmine-spec-reporter": "~4.2.1",
"karma": "^2.0.5",
"karma-chrome-launcher": "~2.2.0",
"karma-cli": "~1.0.1",
"karma-coverage-istanbul-reporter": "^1.2.1",
"karma-jasmine": "~1.1.0",
"karma-jasmine-html-reporter": "^0.2.2",
"protractor": "^5.4.0",
"ts-node": "~3.2.0",
"tslint": "~5.9.1",
"tslint-microsoft-contrib": "^5.2.1",
"typescript": "2.6.2"
}
}

[jvmccarthy]

I'm also running into this NPE at the same line (SanitizePackage:53) when the analyzer is trying to parse the package name. In my case, I'm using a scoped npm package name with the form @myOrg/myPackage. @mum-viadee, are you using a scoped npm package name as well? If so, perhaps this is a problem with handling scoped package names?

[mum-viadee]

Hi @jvmccarthy,
as you can see from my previous post that shows the analysed package.json, I am using scoped package names for all the angular packages. That could be the problem, but by now this is only a shot in the dark.

[lundal]

I had this exact issue today. The error is caused by a package-lock.json without name or version.

Found this stray package-lock.json in my project. Deleting it fixed the issue.

{
  "lockfileVersion": 1
}

[mum-viadee]

Thanks @lundal, I indeed found a stray package-lock,json like yours. Deleting it fixed the issue for me, too.

[jvmccarthy]

Yeah, looks like I was running into an issue with the old version of lerna where the package lock files ended up missing name and version (lerna/lerna#1454).

[mum-viadee]

It looks like there are some ways to produce an invalid package-json.lock. Mine was probably created running npm install in the wrong directory.

I think the Node Analyser needs a better handling for invalid package-json.lock files.

[grEvenX]

I'm running into the same. We use NPM only to include assets during builds and have no plans of publishing any NPM module, so we also don't define any version or name in the package.json file.

The npmjs docs says the following:

If you don’t plan to publish your package, the name and version fields are optional.