XWIKI-16992: Possible NPE when calling ListClass.getStringFromList with a list...

XWIKI-16992: Possible NPE when calling ListClass.getStringFromList with a list containing null values

  * Protect ListClass#getStringFromList from NPE

xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/ListClass.java

@@ -421,40 +421,42 @@ public static String getStringFromList(List<String> list, String separators)
             boolean inEscape = false;
             StringBuilder newValue = new StringBuilder();
 
-            for (int i = 0; i < valueElement.length(); i++) {
-                char currentChar = valueElement.charAt(i);
+            if (valueElement != null) {
+                for (int i = 0; i < valueElement.length(); i++) {
+                    char currentChar = valueElement.charAt(i);
 
-                // if the current char represents an escape, and we're not yet in escape mode, we enter in escape mode
-                if (currentChar == SEPARATOR_ESCAPE && !inEscape) {
-                    inEscape = true;
-                    newValue.append(SEPARATOR_ESCAPE);
-                // if we are already in escape mode: we were escaping the escape character
-                // so we output it and leave the escape mode
-                } else if (currentChar == SEPARATOR_ESCAPE) {
-                    inEscape = false;
-                    newValue.append(SEPARATOR_ESCAPE);
-                // if the current character represents a separator, we need to escape it no matter what
-                } else if (StringUtils.containsAny(separators, currentChar)) {
-                    // if we were in escape mode, it means that the separator was escaped even if it wasn't needed
-                    // so we escape the escape to be able to output it.
-                    // Note that we don't do that generically since we don't want to escape the escape for a normal
-                    // character: List[a\b] is serialized in a\b not in a\\b.
-                    if (inEscape) {
+                    // if the current char represents an escape, and we're not yet in escape mode, we enter in escape mode
+                    if (currentChar == SEPARATOR_ESCAPE && !inEscape) {
+                        inEscape = true;
+                        newValue.append(SEPARATOR_ESCAPE);
+                        // if we are already in escape mode: we were escaping the escape character
+                        // so we output it and leave the escape mode
+                    } else if (currentChar == SEPARATOR_ESCAPE) {
+                        inEscape = false;
                         newValue.append(SEPARATOR_ESCAPE);
+                        // if the current character represents a separator, we need to escape it no matter what
+                    } else if (StringUtils.containsAny(separators, currentChar)) {
+                        // if we were in escape mode, it means that the separator was escaped even if it wasn't needed
+                        // so we escape the escape to be able to output it.
+                        // Note that we don't do that generically since we don't want to escape the escape for a normal
+                        // character: List[a\b] is serialized in a\b not in a\\b.
+                        if (inEscape) {
+                            newValue.append(SEPARATOR_ESCAPE);
+                        }
+                        newValue.append(SEPARATOR_ESCAPE);
+                        newValue.append(currentChar);
+                        inEscape = false;
+                    } else {
+                        newValue.append(currentChar);
+                        inEscape = false;
                     }
+                }
+                // if we are still in escape mode, it means the final character is an escape and we should escape it.
+                if (inEscape) {
                     newValue.append(SEPARATOR_ESCAPE);
-                    newValue.append(currentChar);
-                    inEscape = false;
-                } else {
-                    newValue.append(currentChar);
-                    inEscape = false;
                 }
+                escapedValues.add(newValue.toString());
             }
-            // if we are still in escape mode, it means the final character is an escape and we should escape it.
-            if (inEscape) {
-                newValue.append(SEPARATOR_ESCAPE);
-            }
-            escapedValues.add(newValue.toString());
         }
 
         // Use the first separator to join the list.

xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/objects/classes/ListClassTest.java

@@ -125,6 +125,13 @@ public void testGetStringFromListMultipleSeparatorsWithSeparatorsInValues()
         assertEquals("a\\*b*c\\,d*e\\*f", ListClass.getStringFromList(Arrays.asList("a*b", "c,d", "e*f"), "*,"));
     }
 
+    @Test
+    public void testGetStringFromListWithNullValue()
+    {
+        assertEquals("a.c", ListClass.getStringFromList(Arrays.asList("a", null, "c"), "."));
+        assertEquals("a..c", ListClass.getStringFromList(Arrays.asList("a", "", "c"), "."));
+    }
+
     @Test
     public void getMapFromString()
     {