NullPointerException when deserializing Event object

[clarenced]

I wrote a integration test to test the receipt of webhook notifications. I am passing a payload string (an Event object) to the Webhook.constructEvent(payload, signature, endpointSecret); and it always raises a NullPointerException.

Here is the stact trace :

java.lang.NullPointerException
	at com.stripe.model.BalanceTransactionDeserializer.deserialize(BalanceTransactionDeserializer.java:57)
	at com.stripe.model.BalanceTransactionDeserializer.deserialize(BalanceTransactionDeserializer.java:17)
	at com.google.gson.TreeTypeAdapter.read(TreeTypeAdapter.java:58)
	at com.google.gson.Gson.fromJson(Gson.java:803)
	at com.google.gson.Gson.fromJson(Gson.java:868)
	at com.google.gson.Gson$1.deserialize(Gson.java:126)
	at com.stripe.model.ExpandableFieldDeserializer.deserialize(ExpandableFieldDeserializer.java:36)
	at com.stripe.model.ExpandableFieldDeserializer.deserialize(ExpandableFieldDeserializer.java:8)
	at com.google.gson.TreeTypeAdapter.read(TreeTypeAdapter.java:58)
	at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory$1.read(ReflectiveTypeAdapterFactory.java:93)
	at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory$Adapter.read(ReflectiveTypeAdapterFactory.java:172)
	at com.google.gson.Gson.fromJson(Gson.java:803)
	at com.google.gson.Gson.fromJson(Gson.java:868)
	at com.google.gson.Gson.fromJson(Gson.java:841)
	at com.stripe.model.EventDataDeserializer.deserialize(EventDataDeserializer.java:132)
	at com.stripe.model.EventDataDeserializer.deserialize(EventDataDeserializer.java:17)
	at com.google.gson.TreeTypeAdapter.read(TreeTypeAdapter.java:58)
	at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory$1.read(ReflectiveTypeAdapterFactory.java:93)
	at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory$Adapter.read(ReflectiveTypeAdapterFactory.java:172)
	at com.google.gson.Gson.fromJson(Gson.java:803)
	at com.google.gson.Gson.fromJson(Gson.java:768)
	at com.google.gson.Gson.fromJson(Gson.java:717)
	at com.google.gson.Gson.fromJson(Gson.java:689)
	at com.accor.stripe.tutorial.StripeTest.testWebHook(StripeTest.java:616)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
	at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
	at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)
	at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
	at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:78)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:57)
	at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
	at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
	at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
	at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
	at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
	at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
	at org.eclipse.jdt.internal.junit4.runner.JUnit4TestReference.run(JUnit4TestReference.java:86)
	at org.eclipse.jdt.internal.junit.runner.TestExecution.run(TestExecution.java:38)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:459)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:678)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.run(RemoteTestRunner.java:382)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.main(RemoteTestRunner.java:192)

It seems that the error comes from the class BalanceTransactionDeserializer and at line 57 .

I tried to desereliaze with Event event = APIResource.GSON.fromJson(payload, Event.class);, same error.

Here is the object the Event object I use as a payload :

{
  "id": "evt_1BgwXuErNo417EkDkaKFkmmN",
  "object": "event",
  "account": null,
  "api_version": "2017-06-05",
  "created": 1515163906,
  "data": {
    "object": {
      "id": "ch_1BgwXtErNo417EkDpOhhRu2c",
      "object": "charge",
      "amount": 30000,
      "amount_refunded": 0,
      "application": null,
      "application_fee": null,
      "alternate_statement_descriptors": null,
      "balance_transaction": {
        "id": "txn_1BgwXtErNo417EkDTEffkSBd",
        "expanded_object": null
      },
      "captured": true,
      "created": 1515163905,
      "currency": "cny",
      "customer": null,
      "description": "APS-096852590615833607955PP",
      "destination": {
        "id": "acct_1BDbCEFkpV1s3ySI",
        "expanded_object": null
      },
      "dispute": null,
      "failure_code": null,
      "failure_message": null,
      "fraud_details": {
        "user_report": null,
        "stripe_report": null
      },
      "invoice": null,
      "livemode": false,
      "metadata": {
        "RESA_ID": "APS-096852590615833607955",
        "TRANSACTION_ID": "APS-096852590615833607955PP"
      },
      "outcome": {
        "network_status": "approved_by_network",
        "reason": null,
        "risk_level": "normal",
        "rule": null,
        "seller_message": "Payment complete.",
        "type": "authorized"
      },
      "order": null,
      "paid": true,
      "receipt_email": null,
      "receipt_number": null,
      "refunded": false,
      "refunds": {
        "data": [],
        "total_count": 0,
        "has_more": false,
        "request_options": null,
        "request_params": null,
        "url": "/v1/charges/ch_1BgwXtErNo417EkDpOhhRu2c/refunds",
        "count": null
      },
      "review": null,
      "shipping": null,
      "source": {
        "address_city": null,
        "address_country": null,
        "address_line1": null,
        "address_line1_check": null,
        "address_line2": null,
        "address_state": null,
        "address_zip": null,
        "address_zip_check": null,
        "available_payout_methods": null,
        "brand": "American Express",
        "country": "US",
        "currency": null,
        "cvc_check": "pass",
        "default_for_currency": null,
        "dynamic_last4": null,
        "exp_month": 3,
        "exp_year": 2020,
        "fingerprint": "6ThfTNMoJtW0gM1T",
        "funding": "credit",
        "last4": "0005",
        "name": null,
        "recipient": null,
        "status": null,
        "three_d_secure": null,
        "tokenization_method": null,
        "description": null,
        "iin": null,
        "issuer": null,
        "type": null,
        "id": "card_1BgwXtErNo417EkDrvQk8YDN",
        "object": "card",
        "account": null,
        "customer": null,
        "metadata": {}
      },
      "source_transfer": null,
      "statement_descriptor": null,
      "status": "succeeded",
      "transfer": {
        "id": "tr_1BgwXtErNo417EkDVlDw3xyc",
        "expanded_object": null
      },
      "transfer_group": "group_ch_1BgwXtErNo417EkDpOhhRu2c",
      "card": null,
      "disputed": null,
      "statement_description": null
    },
    "previous_attributes": null
  },
  "livemode": false,
  "pending_webhooks": 0,
  "request": {
    "id": "req_Mb3EXknLMFIsFD",
    "idempotency_key": "APS-096852590615833607955PP"
  },
  "type": "charge.succeeded",
  "user_id": null
}

Can you guys confirm that this is a real issue ?

[ob-stripe]

Hi @clarenced. The event payload you shared looks like it came from an event object that was reserialized by an older version of the Java library.

Specifically this part:

      "balance_transaction": {
        "id": "txn_1BgwXtErNo417EkDTEffkSBd",
        "expanded_object": null
      },

shows that this payload was generated by a version of stripe-java older than 5.23.1.

Can you confirm that:

1. you're using the latest version of the Java library (5.28.0)
2. the payload you're passing to Webhook.constructEvent() is the raw payload that you received in the webhook request. If you deserialize then reserialize the JSON payload, you will end up with a different payload and the signature verification will fail.

[clarenced]

Hi @ob-stripe, you are totally right for the 1st point. I was using a payload that was generated with an old version of the library. After generating a new payload with the latest version, everything is fine now.

Thx for your help

[remi-stripe]

Thanks for confirming @clarenced and glad you could find a fix for this!