Skip to content

Fix NullPointerException in AttachmentStore.retrieveAttachment upon receipt of voice messages#1989

Open
marshallaeon wants to merge 1 commit intoAsamK:masterfrom
marshallaeon:fix/attachment-null-id
Open

Fix NullPointerException in AttachmentStore.retrieveAttachment upon receipt of voice messages#1989
marshallaeon wants to merge 1 commit intoAsamK:masterfrom
marshallaeon:fix/attachment-null-id

Conversation

@marshallaeon
Copy link
Copy Markdown

@marshallaeon marshallaeon commented Mar 26, 2026

Problem

The following happened when I sent a voice message from my Android phone to signal-cli via hermes-agent on my Mac.

AttachmentStore.retrieveAttachment() throws a NullPointerException when called via JSON-RPC with a null attachment ID. This happens when a JSON-RPC client passes the attachment ID under a parameter name that doesn't match the expected id key (e.g. attachmentId). The JsonRpcNamespace lookup returns null, which propagates through to new File(attachmentsPath, null).

Stack trace:

java.lang.NullPointerException
    at java.base/java.io.File.<init>(File.java:366)
    at org.asamk.signal.manager.storage.AttachmentStore.retrieveAttachment(AttachmentStore.java:47)
    at org.asamk.signal.manager.helper.AttachmentHelper.retrieveAttachment(AttachmentHelper.java:44)
    at org.asamk.signal.manager.internal.ManagerImpl.retrieveAttachment(ManagerImpl.java:1709)
    at org.asamk.signal.commands.GetAttachmentCommand.handleCommand(GetAttachmentCommand.java:45)

Fix

Add a null/empty guard in retrieveAttachment() that throws a descriptive IOException instead of an opaque NPE. This makes the error actionable for JSON-RPC clients that send an incorrect parameter name.

When getAttachment is called via JSON-RPC with a parameter name that
doesn't match the expected 'id' key (e.g. 'attachmentId'), the
JsonRpcNamespace returns null for ns.getString("id"). This null value
propagates to AttachmentStore.retrieveAttachment() which passes it to
new File(attachmentsPath, null), causing a NullPointerException.

Add an early null/empty check that throws a descriptive IOException
instead of an opaque NPE. This makes the error actionable for JSON-RPC
clients that send an incorrect parameter name.

Co-Authored-By: Oz <oz-agent@warp.dev>
@marshallaeon marshallaeon changed the title Fix NullPointerException in AttachmentStore.retrieveAttachment Fix NullPointerException in AttachmentStore.retrieveAttachment upon receipt of voice messages Mar 26, 2026
@AsamK
Copy link
Copy Markdown
Owner

AsamK commented Mar 28, 2026

Data should be validated as early as possible. Please add the null check in GetAttachmentCommand instead of AttachmentStore and throw a UserErrorException there.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants