fix(partial): Issue #5144 Avoid NPE on non-Include packageReference

Improved version of #5293. We should not attempt dereference of the null-valued attribute-node of an absent Include attribute
jeremylong · Jan 20, 2023 · de97f1a · de97f1a
1 parent 790d1c3
commit de97f1a
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/core/src/main/java/org/owasp/dependencycheck/data/nuget/XPathMSBuildProjectParser.java b/core/src/main/java/org/owasp/dependencycheck/data/nuget/XPathMSBuildProjectParser.java
@@ -68,11 +68,12 @@ public List<NugetPackageReference> parse(InputStream stream) throws MSBuildProje
                 final Node node = nodeList.item(i);
                 final NamedNodeMap attrs = node.getAttributes();
 
-                final String include = attrs.getNamedItem("Include").getNodeValue();
-                if (include == null) {
+                final Node includeAttr = attrs.getNamedItem("Include");
+                if (includeAttr == null) {
                     // Issue 5144 work-around for NPE on packageReferences other than includes
                     continue;
                 }
+                final String include = includeAttr.getNodeValue();
                 String version = null;
 
                 if (attrs.getNamedItem("Version") != null) {