Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

NullPointer error when adding issue to sitemap

Tristan | Last updated: Mar 04, 2024 03:19PM UTC

Adding AuditIssue via api.sitemap.add(...) causes NullPointerException This can be caused with the following minimal example: \`\`\` import burp.api.montoya.BurpExtension; import burp.api.montoya.MontoyaApi; import burp.api.montoya.http.message.HttpRequestResponse; import burp.api.montoya.scanner.audit.issues.AuditIssue; import burp.api.montoya.scanner.audit.issues.AuditIssueConfidence; import burp.api.montoya.scanner.audit.issues.AuditIssueSeverity; public class ExamplePlugin implements BurpExtension { @Override public void initialize(MontoyaApi api) { String request = "GET / HTTP/1.1\r\nHost: portswigger.net\r\n\r\n"; AuditIssue issue = AuditIssue.auditIssue( "Test Name", "Test Detail", "Test Remediation", "https://portswigger.net/burp", AuditIssueSeverity.INFORMATION, AuditIssueConfidence.FIRM, "Test Background", "Test Remediation Background", AuditIssueSeverity.INFORMATION, HttpRequestResponse.httpRequestResponse( burp.api.montoya.http.message.requests.HttpRequest.httpRequest(request), null ) ); api.siteMap().add(issue); } } \`\`\` Which causes the stack trace: java.lang.NullPointerException: Cannot invoke "Object.hashCode()" because the return value of "burp.Zt5n.Zwp()" is null at burp.Zi3a.ZP(Unknown Source) at burp.Zzb8.hashCode(Unknown Source) at java.base/java.util.HashMap.hash(HashMap.java:338) at java.base/java.util.HashMap.put(HashMap.java:610) at java.base/java.util.HashSet.add(HashSet.java:221) at burp.Ztmd.ZQ(Unknown Source) at burp.Zt7p.ZG(Unknown Source) at burp.Zx17.lambda$outputToDesktopUi$6(Unknown Source) at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.accept(ForEachOps.java:183) at java.base/java.util.stream.SortedOps$SizedRefSortingSink.end(SortedOps.java:357) at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:510) at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499) at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:150) at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:173) at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:596) at burp.Zpv2.ZG(Unknown Source) at burp.Zpv2.ZP(Unknown Source) at burp.Zx17.Zv(Unknown Source) at burp.Zx17.Z_(Unknown Source) at burp.Zx17.lambda$showIssue$3(Unknown Source) at java.desktop/java.awt.event.InvocationEvent.dispatch(InvocationEvent.java:318) at java.desktop/java.awt.EventQueue.dispatchEventImpl(EventQueue.java:773) at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:720) at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:714) at java.base/java.security.AccessController.doPrivileged(AccessController.java:399) at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:86) at java.desktop/java.awt.EventQueue.dispatchEvent(EventQueue.java:742) at java.desktop/java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:203) at java.desktop/java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:124) at java.desktop/java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:113) at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:109) at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:101) at java.desktop/java.awt.EventDispatchThread.run(EventDispatchThread.java:90)

Hannah, PortSwigger Agent | Last updated: Mar 05, 2024 11:06AM UTC

Hi

Thanks for the example.

If you provide an HttpService with your request rather than just the raw request data when raising the issue, do you still experience this error?

HttpRequest.httpRequest(HttpService, HttpRequest)

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.