Fix NPE when application password response is missing password or UUID by adalpari · Pull Request #22952 · wordpress-mobile/WordPress-Android

adalpari · 2026-06-08T14:05:44Z

Description

Fixes a crash when the WordPress.com / WP-API application password endpoint returns a 200 response that is missing the password or uuid field.

ApplicationPasswordCreationResponse declared its fields as non-null, but Gson populates objects via reflection and bypasses Kotlin's null-safety. When the field is absent/null in the JSON, the value flowed into the non-null ApplicationPasswordCreationPayload constructor and threw an NPE. In the minified release build the parameter null-check compiles to a bare getClass() call, which is exactly the reported crash signature.

Fix

Made uuid, name, and password on ApplicationPasswordCreationResponse nullable to match what Gson can actually produce.
Validate the fields on the success path; when either password or uuid is missing, return the existing error payload ("Password or UUID missing from response") instead of crashing. The result propagates as a normal ApplicationPasswordCreationResult.Failure — the same path used for other creation errors.
Applied to both JetpackApplicationPasswordsRestClient (where the crash was reported) and WPApiApplicationPasswordsRestClient, which share the response type.

Tests

Added unit tests for both clients covering: valid response, null password, null uuid, null body, and network error.

Crash report

https://a8c.sentry.io/issues/7522022287/?environment=prod&environment=release&project=5731682&query=release%3A%22com.jetpack.android%4026.8-rc-5%2B1493%22&referrer=release-issue-stream

Reported on com.jetpack.android@26.8-rc-5+1493.

🤖 Generated with Claude Code

dangermattic · 2026-06-08T14:06:25Z

	1 Warning
⚠️	PR is not assigned to a milestone.

Generated by 🚫 Danger

The Gson-deserialized ApplicationPasswordCreationResponse declared its fields as non-null, but Gson populates objects via reflection and bypasses Kotlin's null checks. When the API returns a 200 response missing the `password` or `uuid` field, those nulls flowed into the non-null ApplicationPasswordCreationPayload constructor, crashing the app (in the minified release build the parameter null-check compiles to a bare getClass() call, producing the reported NPE). Make the response fields nullable and validate them, returning the existing error payload instead of crashing. Applied to both the Jetpack and WP-API clients, which share the response type. Crash report: https://a8c.sentry.io/issues/7522022287/ Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

wpmobilebot · 2026-06-08T14:28:01Z

📲 You can test the changes from this Pull Request in WordPress Android by scanning the QR code below to install the corresponding build.

	App Name	WordPress Android
	Build Type	Debug
	Version	pr22952-094e449
	Build Number	`1493`
	Application ID	`org.wordpress.android.prealpha`
	Commit	`094e449`
	Installation URL	3mod7qebfnjrg

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

wpmobilebot · 2026-06-08T14:28:05Z

📲 You can test the changes from this Pull Request in Jetpack Android by scanning the QR code below to install the corresponding build.

	App Name	Jetpack Android
	Build Type	Debug
	Version	pr22952-094e449
	Build Number	`1493`
	Application ID	`com.jetpack.android.prealpha`
	Commit	`094e449`
	Installation URL	061rgbhh63k2o

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

wpmobilebot · 2026-06-08T14:32:28Z

🤖 Build Failure Analysis

This build has failures. Claude has analyzed them - check the build annotations for details.

…-crash

codecov · 2026-06-09T18:05:05Z

Codecov Report

❌ Patch coverage is 90.47619% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 37.38%. Comparing base (00eb108) to head (094e449).
⚠️ Report is 1 commits behind head on release/26.8.

Files with missing lines	Patch %	Lines
...passwords/JetpackApplicationPasswordsRestClient.kt	80.00%	2 Missing ⚠️

Additional details and impacted files

@@               Coverage Diff                @@
##           release/26.8   #22952      +/-   ##
================================================
+ Coverage         37.34%   37.38%   +0.03%     
================================================
  Files              2320     2320              
  Lines            124714   124718       +4     
  Branches          16959    16963       +4     
================================================
+ Hits              46580    46631      +51     
+ Misses            74370    74323      -47     
  Partials           3764     3764

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nbradbury

Looks good!

…-crash

#22952) The Gson-deserialized ApplicationPasswordCreationResponse declared its fields as non-null, but Gson populates objects via reflection and bypasses Kotlin's null checks. When the API returns a 200 response missing the `password` or `uuid` field, those nulls flowed into the non-null ApplicationPasswordCreationPayload constructor, crashing the app (in the minified release build the parameter null-check compiles to a bare getClass() call, producing the reported NPE). Make the response fields nullable and validate them, returning the existing error payload instead of crashing. Applied to both the Jetpack and WP-API clients, which share the response type. Crash report: https://a8c.sentry.io/issues/7522022287/ Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Fix NPE in Site Settings when refreshing GBKit toggle with null site (#22953) The refresh runs from an async onSettingsUpdated callback that only guards with isAdded(), so mSite can be null when isBlockEditorDefault — a non-null Kotlin param — is invoked, crashing on the generated null check. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Fix Sentry 3GCQ/3GDH: keep Gson-deserialized models from R8 full mode (#22954) * Fix Sentry WORDPRESS-ANDROID-3GCQ, WORDPRESS-ANDROID-3GDH: keep recommend models from R8 AGP 9's R8 full mode (introduced in 26.8) was transforming RecommendApiCallsProvider$RecommendTemplateData, causing InstantiationException and ClassCastException when Gson tried to deserialize the /mobile/share-app-link response. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Keep additional Gson-deserialized models from R8 Audit of fromJson<T> call sites surfaced more Kotlin data classes that AGP 9's R8 full mode could class-merge or strip the same way it did to RecommendTemplateData. Adds -keep rules for: - InviteLinksApiCallsProvider.InviteLinksItem - ReaderReadingPreferences (incl. Theme/FontFamily/FontSize enums) - SubfilterListItemMapper.MappedSubfilterListItem - StatsCardsConfiguration + StatsCardType - SubscribersCardsConfiguration + SubscribersCardType - InsightsCardsConfigurationRepository.PersistedConfig + InsightsCardType These have not yet appeared in Sentry for 26.8-rc-5, but the rc-5 user base is small and the affected paths (Reader startup, new stats screens, invite links) are high-traffic enough that they would likely surface in Beta/GA. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Fix NPE when application password response is missing password or UUID (#22952) The Gson-deserialized ApplicationPasswordCreationResponse declared its fields as non-null, but Gson populates objects via reflection and bypasses Kotlin's null checks. When the API returns a 200 response missing the `password` or `uuid` field, those nulls flowed into the non-null ApplicationPasswordCreationPayload constructor, crashing the app (in the minified release build the parameter null-check compiles to a bare getClass() call, producing the reported NPE). Make the response fields nullable and validate them, returning the existing error payload instead of crashing. Applied to both the Jetpack and WP-API clients, which share the response type. Crash report: https://a8c.sentry.io/issues/7522022287/ Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Update translations * Update WordPress metadata translations for 26.8 * Update Jetpack metadata translations for 26.8 * Bump version number * Update translations * Bump version number --------- Co-authored-by: Adalberto Plaza <adalpari@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Nick Bradbury <nbradbury@users.noreply.github.com> Co-authored-by: Automattic Release Bot <mobile+wpmobilebot@automattic.com>

adalpari added the [Type] Bug label Jun 8, 2026

adalpari changed the base branch from trunk to release/26.8 June 8, 2026 14:13

adalpari force-pushed the fix/application-password-null-fields-crash branch from dda20c6 to 0da0911 Compare June 8, 2026 14:14

Merge branch 'release/26.8' into fix/application-password-null-fields…

34da930

…-crash

adalpari marked this pull request as ready for review June 9, 2026 18:05

adalpari requested a review from nbradbury June 9, 2026 18:05

nbradbury approved these changes Jun 9, 2026

View reviewed changes

Merge branch 'release/26.8' into fix/application-password-null-fields…

094e449

…-crash

adalpari enabled auto-merge (squash) June 11, 2026 07:47

adalpari merged commit 6b82a4d into release/26.8 Jun 11, 2026
21 of 22 checks passed

adalpari deleted the fix/application-password-null-fields-crash branch June 11, 2026 08:04

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix NPE when application password response is missing password or UUID#22952

Fix NPE when application password response is missing password or UUID#22952
adalpari merged 3 commits into
release/26.8from
fix/application-password-null-fields-crash

adalpari commented Jun 8, 2026

Uh oh!

dangermattic commented Jun 8, 2026 •

edited

Loading

Uh oh!

wpmobilebot commented Jun 8, 2026 •

edited

Loading

Uh oh!

wpmobilebot commented Jun 8, 2026 •

edited

Loading

Uh oh!

wpmobilebot commented Jun 8, 2026

Uh oh!

codecov Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

nbradbury left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

adalpari commented Jun 8, 2026

Description

Fix

Tests

Crash report

Uh oh!

dangermattic commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wpmobilebot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wpmobilebot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wpmobilebot commented Jun 8, 2026

🤖 Build Failure Analysis

Uh oh!

codecov Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

nbradbury left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

dangermattic commented Jun 8, 2026 •

edited

Loading

wpmobilebot commented Jun 8, 2026 •

edited

Loading

wpmobilebot commented Jun 8, 2026 •

edited

Loading

codecov Bot commented Jun 9, 2026 •

edited

Loading