null dereference fortify fix java

If You Got this error while youre compiling your code? operator is the null-forgiving, or null-suppression, operator. The opinions expressed above are the personal opinions of the authors, not of Micro Focus. It only takes a minute to sign up. Null-pointer dereferences, while common, can generally be found and corrected in a simple way. Closed. The program can potentially dereference a null-pointer, thereby raising a NullException. NullPointerException is a runtime condition where we try to access or modify an object which has not been initialized yet. "Rules for Null Dereference and Redundant Null Check have been reworked to enable reduction of false positive rates. at com.fortify.sca.frontend.Python3FrontEnd.runTranslator(Python3FrontEnd.java:158) [fortify-sca-18.20.1071.jar:?] So this is the error that occurs when we try to dereference a primitive. Follows a very simple code sample that should reproduce the issue: In this simple excerpt Fortify complains that "typedObj" can be null in the return statement. Thanks for contributing an answer to Stack Overflow! As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Our current plan is to remain open for https://t.co/IwbQgYoZUk, Nov 01, We love seeing this enthusiasm for structural pasteurization from realtors https://t.co/ihCVF4uUk3 https://t.co/3uMUV1VabD, Jul 28. Does it just mean failing to correctly check if a value is null? Once the value of the location is obtained by the pointer, this pointer is considered dereferenced. Wait hold on what is dereference now?. How to fix null dereference in C#. Fortify found 2 "Null Dereference" issues. Sign up for a free GitHub account to open an issue and contact its maintainers and the community. at com.fortify.sca.frontend.FrontEndSession.runSingleFrontEnd(FrontEndSession.java:231) [fortify-sca-18.20.1071.jar:?] One may need to close Audit Workbench and reimport the project to see whether the vulnerability goes away from scan report. Closed; is cloned by. There are at least three flavors of this problem: check-after-dereference, dereference-after-check, and dereference-after-store. Null dereference is a commonly occurring defect in Java programs, and many static-analysis tools identify such defects. The most common quality bug identified was the null pointer dereference, which can cause . Explanation Just about every serious attack on a software system begins with the violation of a programmer's assumptions. In Dungeon World, is the Bard's Arcane Art subject to the same failure outcomes as other spells? Explanation. The SAST tool used was Fortify SCA, . This failure seems a result of the Control Flow rules 65 // covering only simple patterns within methods: 66 // allocated -> set 67 // allocated -> checked 68 // allocated -> used 69 // as in the sample rule 70 // riches/scan/Scenario Rules/Null Pointer Check/scenarioRules.xml" 71 log("dangerousLength is " dangerousLength(arg)); 72 log("protected length is " defaultIfEmpty(arg, "").length()); 73 log("StringUtils protected length is " StringUtils.defaultIfEmpty(arg, "").length()); 74 75 // Fortify catches a possible NPE in using a formerly assigned null, 76 // showing a Null Dereference finding. Because your release of resources is conditional on the state of a boolean variable and encased in another try block, the static analyzer must be deciding that rollback() and close() are not guaranteed to execute.. . Why not use a Regular Expression? How to resolve this issue? #icon5632{font-size:;background:;padding:;border-radius:;color:;} (Java) and to compare it with existing bug reports on the tool to test its efficacy. we have been using fortify tool in our code to check for security vulnerabilities. Before using a pointer, ensure that it is not equal to NULL: if (pointer1 != NULL) { /* make use of pointer1 */ /* . One of the common issues reported by Fortify is the Path Manipulation issue. Note that on Red Hat Enterprise Linux 6 it is not possible to exploit CVE-2010-2948 to run arbitrary code as the overflow is blocked by FORTIFY_SOURCE. However, since ES inherits the system use notification/warning banner from the VA Enterprise Identity and Access Management (IAM) Single Sign-On Internal (SSOi) infrastructure when a user initially establishes a session, ES 5.13 is updated to no longer . But, when you try to declare a reference type, something different happens. String fileString = new String(byteArr); String fileSHA256Hex = DigestUtils.sha256Hex(fileString); // use fileSHA256Hex to validate file. For instance, what's wrong with this code? Thanks to both of you; that's much clearer now. Example. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. Also I failed to reproduce the case. Stack Exchange network consists of 181 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers. Null Dereference C/C++ C#/VB.NET/ASP.NET Java/JSP Abstract The program can potentially dereference a null-pointer, thereby raising a NullPointerException. Check the documentation for the Connection object of the type returned by the getConnection() factory method, and see if the methods rollback() and close() will even throw an exception. Bangkok Bank Branch Code List, When you assign the value of 10 on the second line, your value of 10 is written into the memory location referred to by x. . Investigate instances where Fortify has identified a null pointer as a potential security flaw. If connection is null, it will still throw an exception. When you have a variable of non-primitive type, it is a reference to an object. In this paper we discuss some of the challenges of using a null dereference analysis in practice, and reasons why developers may not feel it necessary to change code to prevent ever possible null dereference. You also had the guts to say "never check for null" (if null is invalid).Placing an assert() in every member function that dereferences a pointer is a compromise that will likely placate a lot of people, but even that feels like 'speculative paranoia' to me. Is it plausible for constructed languages to be used to affect thought and control or mold people towards desired outcomes? The NULL pointer dereference weakness occurs where application dereferences a pointer that is expected to be a valid address but instead is equal to NULL. An attack signature is a unique arrangement of information that can be used to identify an attacker's attempt to exploit a known operating system or application vulnerability. If connection is null, it will still throw an exception. When it comes to these specific properties, you're safe. Scala 2.11.6 or newer. The main theme of Dereferencing is placing the memory address into the reference. Private personal information may include a password, phone number, geographic location, personal messages, credit card number, etc. In the most recent project scanned, only 1 of 24 Null Dereference issues found was legitamite. Computers are deterministic machines, and as such are unable to produce true randomness. beyond that why are you scanning possible characters instead of just checking upper and lower limits. Why is this sentence from The Great Gatsby grammatical? Fortify flags this for null dereference. It would probably help prioritizing a fix if you could attach your repro code. Chances are they have and don't get it. There are some Fortify links at the end of the article for your reference. Pseudo-Random Number Generators (PRNGs) approximate randomness algorithmically, starting with a seed from . When it comes to these specific properties, you're safe. Successfully merging a pull request may close this issue. Connect and share knowledge within a single location that is structured and easy to search. The CWE Top 25. . Fix Suggenstion 11Null Dereference. Security problems result from trusting input. The null-guarded behaviour would be non-idiomatic and surprising in C++, and therefore should be considered harmful. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners. Network Operations Management (NNM and Network Automation). The opinions expressed above are the personal opinions of the authors, not of Micro Focus. ThermaPure has over 15 years of experience training individuals and organizations to use heat to remediate structures and kill pests. how to fix null dereference in java fortify Literal null values are passed as the third and fourth arguments.In the definition of set, It works under 64-bit systems in Windows, Linux and macOS environments, and can analyze source code intended for 32-bit, 64-bit and embedded ARM platforms. So mark them as Not an issue and move on. This release, developed in Java technology, contains ESM Phase 3 development and upgrade efforts. If you get an exception, don't catch it and return null, instead wrap and rethrow the exception. The root cause of each defect is clearly explained, making it easy to fix bugs Integrated with However, one article [1] claims that the cost of a one year license is based on the number of lines of code, regardless of the number of users. Check the documentation for the Connection object of the type returned by the getConnection() factory method, and see if the methods rollback() and close() will even throw an exception. In this example, the variable x is an int and Java will initialize it to 0 for you. Chain: Use of an unimplemented network socket operation pointing to an uninitialized handler function ( CWE-456) causes a crash because of a null pointer dereference ( CWE-476 ). You signed in with another tab or window. However, its // behavior isn't consistent. Fortify-Issue-300 Null Dereference issues #302. I'm using "HP Fortify v3.50" on a java project and I find lots of false positive on "Null Dereference", because Fortify doesn't see the control against null is in another method. How to Check if Application is Installed in Your Android Phone and Open the App? Exceptions. +1 (416) 849-8900. When we dereference a pointer, then the value of the . Null Dereference Object Model Violation: Just one of equals() and hashCode() Defined Dead Code: Unused Field As we already know that "what is a pointer", a pointer is a variable that stores the address of another variable.The dereference operator is also known as an indirection operator, which is represented by (*). 10 Avoiding Attempt to Dereference Null Object Errors 4,029 views Oct 22, 2014 In this episode we look at 3 common ways to get - and then prevent - the "Attempt to dereference a null object". Explanation Just about every serious attack on a software system begins with the violation of a programmer's assumptions. If I had to guess, the tool you're using is complaining about our use of Math.random() but we don't rely on it being cryptographically secure. Provide an answer or move on to the next question. But we have observed in practice that not every potential null dereference is a "bug" that developers want to fix. This means sum.something() is an INVALID Syntax in Java. Linux reduced time to fix new defects, found by Coverity Scan, from 120 days to 5 days. Null Dereference C/C++ C#/VB.NET/ASP.NET Java/JSP Abstract clones. . Share Improve this answer Follow edited Jun 4, 2019 at 17:08 answered Jun 4, 2019 at 17:01 Thierry 5,170 33 39 Most null pointer issues result in general software reliability problems, but if attackers can intentionally trigger a null pointer dereference, they can use the resulting exception to bypass security logic or to cause the application to reveal debugging information that will be valuable in planning subsequent attacks. I believe this particular behavior is a gap in the Fortify analyzer implementation, as all other static analysis tools seem to understand the code flow and will not complain about potential null references in this case. All rights reserved. The best answers are voted up and rise to the top, Not the answer you're looking for? For example: org.apache.commons.lang3.StringUtils.defaultIfEmpty() 90 int npeV = npe.frugalCopy().getV(); 91 92 log("Called a method of an object returned by a method: " npeV); 93 94 if (npeV == 2) { 95 System.clearProperty("os.name"); 96 } 97 98 String os = System.getProperty("os.name"); 99 // Fortify catches a possible NPE where null signals absence of a 100 // resource, showing a Missing Check against Null finding. Note: Before moving to this, to fix the issue in Example 1 we can print, The program can dereference a null-pointer because it does not check the return value of a function that might return null. For an attacker it provides an opportunity to stress the system in unexpected ways. Browse other questions tagged, Start here for a quick overview of the site, Detailed answers to any questions you might have, Discuss the workings and policies of this site. 2Null Dereference 2.1 null null dereference-after-store . Redundant Null Check. As a counter-example, though, note that calling free() or delete on a NULL in C and C++ is guaranteed to be a no-op. The repro was confirmed by the support representative and the case forwarded to the engineering team. But we have observed in practice that not every potential null dereference is a "bug " that developers want to fix. Already on GitHub? We can fix this issue just by replacing the .equals() method with== so lets implement == symbol and try to compile our code. I don't see a problem in line 5. Fix : Analysis found that this is a false positive result; no code changes are required. . The issues include: "Buffer Overflows," "Cross-Site Scripting" attacks, "SQL Injection," and many others. operator is the logical negation operator. Unchecked return value leads to resultant integer overflow and code execution. Jk Robbins wrote:The FindBugs tool is telling me that line 5 contains a null pointer dereference to the id variable but I don't see the problem. How can i resolve this issue? Pointers are variables that store the memory address of an object, and a null pointer dereference occurs when you try to access an object . #icon5632:hover{color:;background:;} 180 Canada Larga Rd. */ } What I am trying to do is initialize ApplicanteeTO object with null, then check if it is under certain population type, populate it. I believe this particular behavior is a gap in the Fortify analyzer implementation, as all other static analysis tools seem to understand the code flow and will not complain about potential null references in this case. Fortify-Issue-300 Null Dereference issues. Liberalism Used In A Sentence, a NULL pointer dereference would then occur in the call to strcpy(). null dereference fortify fix javameat carving knife blank. Team Collaboration and Endpoint Management. The Java VM sets them so, as long as Java isn't corrupted, you're safe. NULL pointer dereference erros are common in C/C++ languages. This could allow the server to make the client crash due to the NULL pointer dereference Separate licenses are available for C/C++ analysis and Java analysis. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. When it comes to these specific properties, you're safe. If that variable hasn't had a reference assigned, it's a null reference, which (for internal/historical reasons) is referred to as a null pointer. This option is only active when -fdelete-null-pointer-checks is active, which is enabled by optimizations in most targets. I believe this particular behavior is a gap in the Fortify analyzer implementation, as all other static analysis tools seem to understand the code flow and will not complain about potential null references in this case. OpenFromXML.java, line 545 (Password Management: Empty Password) . We also report experimental results for XYLEM, Coverity Prevent, Fortify SCA, Eclipse and FindBugs, and observe of Computer Science University of Maryland College Park, MD [email protected] Abstract Many analysis techniques have been proposed to determine when a potentially null value may be You won't find it anywhere in any official Java documents. The Java VM sets them so, as long as Java isn't corrupted, you're safe. Try this: if (connection != null && conection.State != ConnectionState.Closed) { conection.Close (); } But better, use a using block around your connection creation so it is automatically closed and disposed when it goes out of scope. : System.getProperty may return NULL NPE.java(98) : allocated -> allocated : os may be null NPE.java(101) : allocated -> used : os.equalsIgnoreCase() : os used without null check[A423998C51F661CE8B2EB269BB0AF58D : low : Poor Logging Practice : Use of a System Output Stream : structural ] NPE.java(43)[5494E2A573D3F6F3F5F24DE49D893068 : low : J2EE Bad Practices : Leftover Debug Code : structural ] NPE.java(56)$ cat -n NPE.java 1 package npe; 2 3 import org.apache.commons.lang3.StringUtils; 4 5 public class NPE { 6 int v; 7 8 9 public NPE(int v) { 10 this.v = v; 11 } 12 13 14 public static int dangerousLength(String s) { 15 return s.length(); 16 } 17 18 19 public String stringify() { 20 if (v != 0) { 21 return "non-0"; 22 } else { 23 return null; 24 } 25 } 26 27 28 public NPE frugalCopy() { 29 if (v != 0) { 30 return new NPE(v); 31 } else { 32 return null; 33 } 34 } 35 36 37 public int getV() { 38 return v; 39 } 40 41 42 public static void log(String s) { 43 System.out.println(s); 44 } 45 46 47 public static String defaultIfEmpty(String s, String v) { 48 if (s == null || s.length() == 0) { 49 return v; 50 } else { 51 return s; 52 } 53 } 54 55 56 public static void main(String[] args) { 57 String arg = null; 58 if (args.length > 0) { 59 arg = args[0]; 60 } 61 log("arg is " arg); 62 63 // Fortify fails to catch a possible NPE when the null is passed as an 64 // argument. How can I reduce false positives and maintain the rule? They should be investigated and fixed OR suppressed as not a bug. Initializes a new instance of the NullReferenceException class, setting the Message property of the new instance to a system-supplied message that describes the error, such as "The value 'null' was found where an instance of an object was required." The nature of simulating nature: A Q&A with IBM Quantum researcher Dr. Jamie We've added a "Necessary cookies only" option to the cookie consent popup. . #channelislandsharbor #oxnard @ C https://t.co/ns1WvY7xHh, Nov 29, Happy Thanksgiving from all of us at ThermaPure! Fix : Analysis found that this is a false positive result; no code changes are required. Null-pointer exceptions usually occur when one or more of the programmer's assumptions is violated. Do you need your, CodeProject, What I mean is, you must remember to set the pointer to NULL or it won't work. Posted 29-Sep-17 0:30am OriginalGriff Comments The latest patch releases are recommended (2.13.5, 2.12.13, and 2.11.12 as of February 2021). For example, if a program fails to call chdir() after calling chroot() , it violates the contract that specifies how to change the active root directory in a secure fashion. However, most of the existing tools This bug was quite hard to spot! Null Dereference (Code Quality, Control Flow): The method ThroughDate() in Program.cs can dereference a null pointer, thereby raising a NullException. "The good news about computers is that they do what you tell them to do. On File delete, using java File delete method what could be the security issue? to fix over 7500 defects across 250 open source projects and 50 million lines of code. In this article. The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. The program can potentially dereference a null-pointer, thereby raising a NullPointerException. How to Fix int cannot be dereferenced error? Explanation Null-pointer errors are usually the result of one or more programmer assumptions being violated. To actually scan translated code for vulnerabilities, you must either: be a licensed Fortify SCA user. Fix: Modified rules and code to no longer dereference a null pointer. The bad news is that they do what you tell them to do." If you have a method that should sometimes not return a value, you could return an empty Collection, or an Optional, which is new in Java 8. Accessing or modifying a null objects field. Then by the end of this article, you will get complete knowledge about the error and able to solve your issue, lets start with an example. Now, let us move to the solution for this error, How to Fix "int cannot be dereferenced" error? #icon8226{font-size:;background:;padding:;border-radius:;color:;} ][C:/DIR/npe][38F1CD7C547F94C73D421BDC0BA6B45B : low : System Information Leak : Internal : dataflow ]NPE.java(43) : ->PrintStream.println(0) NPE.java(102) : ->NPE.log(0) NPE.java(98) : <=> (os) NPE.java(98) : <- System.getProperty(return)[38F1CD7C547F94C73D421BDC0BA6B45C : low : System Information Leak : Internal : dataflow ]NPE.java(43) : ->PrintStream.println(0) NPE.java(111) : ->NPE.log(0) NPE.java(109) : <=> (os2) NPE.java(51) : return (s) NPE.java(109) : <->NPE.defaultIfEmpty(0->return) NPE.java(109) : <- System.getProperty(return)[B679BDBBFADB6AD00720E35440F876F7 : high : Null Dereference : controlflow ] NPE.java(57) : Assigned null : arg NPE.java(58) : Branch not taken: ((args.length) <= 0) NPE.java(77) : Dereferenced : arg[935183D4911A3F55EEA10E64B6BDC2F6 : low : Missing Check against Null : controlflow ] NPE.java(98) : start -> allocated : os = getProperty(?) Warn if the compiler detects paths that trigger erroneous or undefined behavior due to dereferencing a null pointer. A null pointer dereference, on the other hand, is a specific type of null dereference that occurs when you try to access an object reference that has a null value in a programming language that uses pointers. To subscribe to this RSS feed, copy and paste this URL into your RSS reader. at com.fortify.sca.frontend.FrontEndSession.runFrontEnd(FrontEndSession.java:193) [fortify-sca-18.20.1071.jar:?] Null Dereference C/C++ C#/VB.NET/ASP.NET Java/JSP Abstract The program can potentially dereference a null-pointer, thereby raising a NullPointerException. As a matter of fact, any miss in dealing with null cannot be identified at compile time and results in a NullPointerException at runtime. But I do see a problem in line 9: Thanks, you are correct, I meant line 9 and I see the error now. to your account. : Fortify: The method processMessage() in VET360InboundProcessService.java can crash the program by dereferencing a null pointer on line 197. rev2023.3.3.43278. Have a question about this project? TimeZone getOffset(int, int, int, int, int, int) Method in Java with Examples, ZoneOffset ofHoursMinutesSeconds(int, int, int) method in Java with Examples, SimpleTimeZone setStartRule(int, int, int) method in Java with Examples, SimpleTimeZone setEndRule(int, int, int) method in Java with Examples, HijrahDate of(int, int, int) method in Java with Example, IsoChronology date(int, int, int) method in Java with Example, JapaneseChronology date(int, int, int) method in Java with Example, JapaneseDate of(int, int, int) method in Java with Example, JapaneseDate of(JapaneseEra,int, int, int) method in Java with Example, MinguoChronology date(int, int, int) method in Java with Example. IsNullOrEmpty is a convenience method that enables you to simultaneously test whether a String is Nothing or its value is Empty. PS: Yes, Fortify should know that these properties are secure. Difference Between FileInputStream and FileReader in Java, Introduction about the error with example. NullPointerException is thrown when program attempts to use an object reference that has the null value. In my attempts I see that Fortify may lack knowledge of null-sanitizing methods but any method will quiet down the Null Dereference rule. NPD vulnerability can be exploited by hackers to maliciously crash a process to cause a denial of service or execute an arbitrary code under specific conditions. Fortify Null Dereference in Java; Chain Validation test; Apigee issue with PUT and POST operation; Query annotation not working with and / or operators; org.springframework.beans.factory.BeanDefinitionStoreException: Failed to process import candidates for configuration class Fortify: Null Dereference and Portability Flaw: Locale Dependent Comparison. Insecure randomness errors occur when a function that can produce predictable values is used as a source of randomness in security-sensitive context. If foo is null when it is checked in the if statement, then a null dereference will occur, thereby causing a null-pointer exception. The program can dereference a null-pointer because it does not check the return value of a function that might return null. Note: Before moving to this, to fix the issue in Example 1 we can print. The opinions expressed above are the personal opinions of the authors, not of Micro Focus. I know we could change the code to remove it, but that would be changing the structure of our code because of a problem in the tool. The call cr.getPassword() may return null value in the com.hazelcast.client.connection.nio.ClientConnectionManagerImpl.encodeAuthenticationRequest(boolean, SerializationService, ClientPrincipal) method. EXP01-J-EX0: A method may dereference an object-typed parameter without guarantee that it is a valid object reference provided that the method documents that it (potentially) throws a NullPointerException, either via the throws clause of the method or in the method comments. Is it correct to use "the" before "materials used in making buildings are"? Neuropsychologist Salary Us, 2.1.1Null Dereference. Extended Description NULL pointer dereference issues can occur through a number of flaws, including race conditions, and simple programming omissions. The precision of the warnings depends on the optimization options used. CONNECT Software project. This type of 'return early' pattern is very common with validation as it avoids nested scopes thus making the code easier to read in general. Null pointers null dereference null dereference - best practices Using Nullable type parameters Memory leak Unmanaged memory leaks. Initializes a new instance of the NullReferenceException class, setting the Message property of the new instance to a system-supplied message that describes the error, such as "The value 'null' was found where an instance of an object was required." 2 Answers Sorted by: 4 Fortify is raising an issue, not an error because you are taken input from the process's environment and then opening a path with it without doing any input filtering. But what exactly does it mean to "dereference a null pointer"? (partial fix)) 1.0.5 (February 7, 2018) handle source files with any character encoding (issue 267) Scala 2.11.6 and 2.11.7 are now supported (issue 217) Fortify prioritizes and categorizes the findings so that we can address them immediately." Finally, how to fix the issue with Example code and output. CODETOOLS-7900079 Fortify: Analize and fix "Code Correctness: Regular Expressions Denial of Service" issues. When you assign the value of 10 on the second line, your value of 10 is written into the memory location referred to by x. Closed. 0f66c64 (0.15.0) add scripts to check git repo sha lanxia [#6506] 4a7a6b2 (v0.15.0) Fix out-of-bounds write in String.getBytes Benjamin Thomas (Aviansie Ben) [#6502] d58e0f7 (0.15.0) Invoke DomainCombiner.combine() for embedded AccessControlContext Peter Shipton [#6493] 18e7a3c (v0.15.0) Remove extra rpaths in AIX shared libs mikezhang [#6494 . However, it is unclear if the benefits are universal in nature. That's why it's perfectly OK to assign null to variables or pass null into a method. Thus, enabling the attacker do delete files or otherwise compromise your system. . How can I ensure that fortify consider these calls as valid null checks? For example, if a program fails to call chdir() after calling chroot() , it violates the contract that specifies how to change the active root directory in a secure fashion. Primitive [byte, char, short, int, long, float, double, boolean]. This agrees with Fortify's 81 // alleged lack of tracking method calls and assignments in its 82 // high-risk Null Dereference rule. This release includes enhancements and defect fixes to support ESCC and ES Sustainment. Dereference before null check (REVERSE_INULL) There may be a null pointer exception, or else the . The purpose of this Release Notes document is to announce the release of the ES 5.14. . Note that you can copy references without accessing the object it references. I have a solution to the Fortify Path Manipulation issues. Test every line of code and potential execution path. Merged. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. privacy statement. Jk Robbins wrote:Thanks, you are correct, I meant line 9 and I see the error now. Whenever we use the "return early" code pattern, Fortify is not able to understand it and raises a "possible null dereference" warning. If a question is poorly phrased then either ask for clarification, ignore it, or. Most null-pointer issues result in general software reliability problems, but if an attacker can intentionally trigger a null-pointer dereference, the attacker may be able to use the resulting exception to bypass security logic or to cause the application to reveal debugging information Also, the term 'pointer' is bad (but maybe it comes from the FindBugs tool): Java doesn't have pointers, it has references. -- Ted Nelson.