[java] HardCodedCryptoKey: NPE when constants from parent class are used

[zbynek]

Describe the PR

Rule: HardCodedCryptoKey

Adds a null check in case the accessed field is not defined in the current class. When the null check fails, check if the field is a compile time constant.

The changed code is shared with InsecureCryptoIv, the fix applies to both rules.

For reference, the fixed NPE stacktrace

[WARNING] Exception applying rule HardCodedCryptoKey on file /home/mag/project/civitas-ng/civitas.externalcrypto/src/test/java/civitas/crypto/CryptoBaseTest.java, continuing with next rule
org.apache.commons.lang3.exception.ContextedRuntimeException: java.lang.NullPointerException: Cannot invoke "net.sourceforge.pmd.lang.java.ast.ASTVariableId.getInitializer()" because "varDecl" is null
Exception Context:
        [1:Rule applied on node=!debug only! [ConstructorCall:82:28]new SecretKeySpec(SOMESTRING.getBytes(), SHARED_KEY_ALG)]
---------------------------------
    at net.sourceforge.pmd.util.AssertionUtil.contexted (AssertionUtil.java:257)
    at net.sourceforge.pmd.lang.rule.internal.RuleApplicator.applyOnIndex (RuleApplicator.java:79)
    at net.sourceforge.pmd.lang.rule.internal.RuleApplicator.apply (RuleApplicator.java:57)
    at net.sourceforge.pmd.lang.rule.internal.RuleSets.apply (RuleSets.java:183)
    at net.sourceforge.pmd.lang.impl.PmdRunnable.processSource (PmdRunnable.java:140)
    at net.sourceforge.pmd.lang.impl.PmdRunnable.run (PmdRunnable.java:80)
    at java.util.concurrent.Executors$RunnableAdapter.call (Executors.java:572)
    at java.util.concurrent.FutureTask.run (FutureTask.java:317)
    at java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1144)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:642)
    at java.lang.Thread.run (Thread.java:1583)
Caused by: java.lang.NullPointerException: Cannot invoke "net.sourceforge.pmd.lang.java.ast.ASTVariableId.getInitializer()" because "varDecl" is null
    at net.sourceforge.pmd.lang.java.rule.security.AbstractHardCodedConstructorArgsVisitor.validateProperKeyArgument (AbstractHardCodedConstructorArgsVisitor.java:68)
    at net.sourceforge.pmd.lang.java.rule.security.AbstractHardCodedConstructorArgsVisitor.visit (AbstractHardCodedConstructorArgsVisitor.java:35)
    at net.sourceforge.pmd.lang.java.rule.security.HardCodedCryptoKeyRule.visit (HardCodedCryptoKeyRule.java:14)
    at net.sourceforge.pmd.lang.java.ast.ASTConstructorCall.acceptVisitor (ASTConstructorCall.java:34)
    at net.sourceforge.pmd.lang.java.ast.AbstractJavaNode.acceptVisitor (AbstractJavaNode.java:38)
    at net.sourceforge.pmd.lang.java.rule.AbstractJavaRule.apply (AbstractJavaRule.java:30)
    at net.sourceforge.pmd.lang.rule.RuleReference.apply (RuleReference.java:413)
    at net.sourceforge.pmd.lang.rule.internal.RuleApplicator.applyOnIndex (RuleApplicator.java:77)
    at net.sourceforge.pmd.lang.rule.internal.RuleApplicator.apply (RuleApplicator.java:57)
    at net.sourceforge.pmd.lang.rule.internal.RuleSets.apply (RuleSets.java:183)
    at net.sourceforge.pmd.lang.impl.PmdRunnable.processSource (PmdRunnable.java:140)
    at net.sourceforge.pmd.lang.impl.PmdRunnable.run (PmdRunnable.java:80)
    at java.util.concurrent.Executors$RunnableAdapter.call (Executors.java:572)
    at java.util.concurrent.FutureTask.run (FutureTask.java:317)
    at java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1144)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:642)
    at java.lang.Thread.run (Thread.java:1583)

Related issues

reported in discussion #6186

Ready?

• Added unit tests for fixed bug/feature
• Passing all unit tests
• Complete build ./mvnw clean verify passes (checked automatically by github actions)
• Added (in-code) documentation (if needed)

[pmd-actions-helper]

Documentation Preview

No regression tested rules have been changed.

(comment created at 2025-10-30 12:10:05+00:00 for f412ba4)

[adangel]

Thanks!