WorkflowResource.saveComment() returns 500 (NPE) when the Contentlet has no workflow task
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 970
- Forks
- 486
- Avg merge
- 3d 33m
- Merged PRs (30d)
- 170
Description
Problem Statement
WorkflowResource.saveComment() dereferences the result of findTaskByContentlet without a null
check, so posting a Workflow comment against a Contentlet that has no workflow_task row throws an
NPE and returns HTTP 500.
dotCMS/src/main/java/com/dotcms/rest/api/v1/workflow/WorkflowResource.java:6402-6407
final WorkflowTask task = this.workflowAPI.findTaskByContentlet(currentContentlet.get());
final WorkflowComment taskComment = new WorkflowComment();
...
taskComment.setWorkflowtaskId(task.getId()); // NPE when task is null
WorkFlowFactoryImpl.findTaskByContentlet returns null whenever no task row exists for that
(identifier, languageId) pair — see WorkFlowFactoryImpl.java:1098-1128.
This is the same defect class fixed at the sibling getWorkflowTasksHistoryComments() endpoint
~110 lines above in #37589, for #37584. Found by review on that PR and deliberately left out of it
to keep the fix inside the reported bug's scope.
Severity / Impact: a Site can never have a Workflow task at all (Workflow actions are prohibited
on the Host Content Type), so every attempt to comment on one fails. Any Contentlet whose task was
never created or has been deleted hits it too.
Steps to Reproduce
POST /api/v1/workflow/tasks/comments/{contentletIdentifier}for a Site identifier (or for any
Contentlet with noworkflow_taskrow).- Observe HTTP 500 with
Cannot invoke "…WorkflowTask.getId()" because "task" is null.
Expected: a clear, typed response — not an NPE. Whether that is 404, 400 or an
auto-created task is a product decision; the current behaviour is simply a crash.
Reproducibility: Always.
Suggested Fix
Guard the null and return a deliberate response. Note this endpoint writes, so unlike the
read-side fix in #37589, an empty result is not the right answer — the caller asked to record a
comment and it was not recorded.
Notes
Related: #37584, #37589. WorkflowResource.java:6121 has a third findTaskByContentlet call worth
checking while in there.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in dotCMS/src/main/java/com/dotcms/rest/api/v1/workflow/WorkflowResource.java at lines 6402-6407 and inspect the related findTaskByContentlet call near line 6121. Compare the sibling fix in #37589 and the behavior of WorkFlowFactoryImpl.java:1098-1128. Done means posting a comment without a workflow task returns a deliberate typed response instead of HTTP 500, with the product choice for 404, 400, or task creation resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100