dotCMS / dotCMS/core

WorkflowResource.saveComment() returns 500 (NPE) when the Contentlet has no workflow task

Open
#37,605 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Type : Defect
Dominant language
Java
Stars
970
Forks
486
Avg merge
3d 33m
Merged PRs (30d)
170

Description

Problem Statement

WorkflowResource.saveComment() dereferences the result of findTaskByContentlet without a null
check, so posting a Workflow comment against a Contentlet that has no workflow_task row throws an
NPE and returns HTTP 500.

dotCMS/src/main/java/com/dotcms/rest/api/v1/workflow/WorkflowResource.java:6402-6407

final WorkflowTask task = this.workflowAPI.findTaskByContentlet(currentContentlet.get());
final WorkflowComment taskComment = new WorkflowComment();
...
taskComment.setWorkflowtaskId(task.getId());   // NPE when task is null

WorkFlowFactoryImpl.findTaskByContentlet returns null whenever no task row exists for that
(identifier, languageId) pair — see WorkFlowFactoryImpl.java:1098-1128.

This is the same defect class fixed at the sibling getWorkflowTasksHistoryComments() endpoint
~110 lines above in #37589, for #37584. Found by review on that PR and deliberately left out of it
to keep the fix inside the reported bug's scope.

Severity / Impact: a Site can never have a Workflow task at all (Workflow actions are prohibited
on the Host Content Type), so every attempt to comment on one fails. Any Contentlet whose task was
never created or has been deleted hits it too.

Steps to Reproduce

  1. POST /api/v1/workflow/tasks/comments/{contentletIdentifier} for a Site identifier (or for any
    Contentlet with no workflow_task row).
  2. Observe HTTP 500 with Cannot invoke "…WorkflowTask.getId()" because "task" is null.

Expected: a clear, typed response — not an NPE. Whether that is 404, 400 or an
auto-created task is a product decision; the current behaviour is simply a crash.

Reproducibility: Always.

Suggested Fix

Guard the null and return a deliberate response. Note this endpoint writes, so unlike the
read-side fix in #37589, an empty result is not the right answer — the caller asked to record a
comment and it was not recorded.

Notes

Related: #37584, #37589. WorkflowResource.java:6121 has a third findTaskByContentlet call worth
checking while in there.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in dotCMS/src/main/java/com/dotcms/rest/api/v1/workflow/WorkflowResource.java at lines 6402-6407 and inspect the related findTaskByContentlet call near line 6121. Compare the sibling fix in #37589 and the behavior of WorkFlowFactoryImpl.java:1098-1128. Done means posting a comment without a workflow task returns a deliberate typed response instead of HTTP 500, with the product choice for 404, 400, or task creation resolved.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.