# NullPointerException in Sonar Scanner with rule ReflectedXssCheck

**URL:** <https://community.sonarsource.com/t/nullpointerexception-in-sonar-scanner-with-rule-reflectedxsscheck/103237>\
**Category:** SonarQube Server / Community Build\
**Tags:** scanner\
**Created:** [October 25, 2023, 9:31am UTC](https://community.sonarsource.com/t/nullpointerexception-in-sonar-scanner-with-rule-reflectedxsscheck/103237 "2023-10-25T09:31:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nicolas\_Baumann](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/nicolas_baumann/32/72625_2.png) [@Nicolas\_Baumann](https://community.sonarsource.com/u/Nicolas_Baumann)\
**Post date:** [October 25, 2023, 9:31am UTC](https://community.sonarsource.com/t/nullpointerexception-in-sonar-scanner-with-rule-reflectedxsscheck/103237/1 "2023-10-25T09:31:09Z")

</div>

Hi,

I had NullPointerException while scanning:

> ERROR: Cannot generate ucfg for file path/to/Java.class for method at line 166  
> java.lang.NullPointerException: Cannot invoke “org.sonar.plugins.java.api.semantic.Symbol.type()” because “” is null  
> at com.sonar.security.frontend.java.N.A(na:2514)  
> at com.sonar.security.frontend.java.N.visitIdentifier(na:2184)  
> at org.sonar.java.model.expression.IdentifierTreeImpl.accept(IdentifierTreeImpl.java:98)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitContinueStatement(BaseTreeVisitor.java:181)  
> at org.sonar.java.model.statement.ContinueStatementTreeImpl.accept(ContinueStatementTreeImpl.java:72)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:34)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitBlock(BaseTreeVisitor.java:87)  
> at org.sonar.java.model.statement.BlockTreeImpl.accept(BlockTreeImpl.java:75)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitIfStatement(BaseTreeVisitor.java:109)  
> at org.sonar.java.model.statement.IfStatementTreeImpl.accept(IfStatementTreeImpl.java:103)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:34)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitBlock(BaseTreeVisitor.java:87)  
> at org.sonar.java.model.statement.BlockTreeImpl.accept(BlockTreeImpl.java:75)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitForEachStatement(BaseTreeVisitor.java:166)  
> at org.sonar.java.model.statement.ForEachStatementImpl.accept(ForEachStatementImpl.java:99)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:34)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitBlock(BaseTreeVisitor.java:87)  
> at org.sonar.java.model.statement.BlockTreeImpl.accept(BlockTreeImpl.java:75)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitForEachStatement(BaseTreeVisitor.java:166)  
> at org.sonar.java.model.statement.ForEachStatementImpl.accept(ForEachStatementImpl.java:99)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitLabeledStatement(BaseTreeVisitor.java:98)  
> at org.sonar.java.model.statement.LabeledStatementTreeImpl.accept(LabeledStatementTreeImpl.java:77)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:34)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitBlock(BaseTreeVisitor.java:87)  
> at org.sonar.java.model.statement.BlockTreeImpl.accept(BlockTreeImpl.java:75)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at com.sonar.security.frontend.java.N.visitLambdaExpression(na:355)  
> at org.sonar.java.model.expression.LambdaExpressionTreeImpl.accept(LambdaExpressionTreeImpl.java:100)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitReturnStatement(BaseTreeVisitor.java:186)  
> at org.sonar.java.model.statement.ReturnStatementTreeImpl.accept(ReturnStatementTreeImpl.java:70)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:34)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitBlock(BaseTreeVisitor.java:87)  
> at org.sonar.java.model.statement.BlockTreeImpl.accept(BlockTreeImpl.java:75)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitMethod(BaseTreeVisitor.java:82)  
> at org.sonar.java.model.declaration.MethodTreeImpl.accept(MethodTreeImpl.java:231)  
> at com.sonar.security.frontend.java.F.buildUCfg(na:2144)  
> at com.sonar.security.frontend.java.F.serializeUCFG(na:675)  
> at com.sonar.security.frontend.java.F.visitMethod(na:1996)  
> at org.sonar.java.model.declaration.MethodTreeImpl.accept(MethodTreeImpl.java:231)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:34)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitClass(BaseTreeVisitor.java:70)  
> at com.sonar.security.frontend.java.F.visitClass(na:1845)  
> at org.sonar.java.model.declaration.ClassTreeImpl.accept(ClassTreeImpl.java:220)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:34)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitCompilationUnit(BaseTreeVisitor.java:52)  
> at org.sonar.java.model.JavaTree$CompilationUnitTreeImpl.accept(JavaTree.java:196)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at com.sonar.security.frontend.java.F.scanFile(na:1902)  
> at com.sonar.security.frontend.java.rules.A.scanFile(na:3426)  
> at org.sonar.java.model.VisitorsBridge.lambda$runScanner$1(VisitorsBridge.java:260)  
> at org.sonar.java.model.VisitorsBridge.runScanner(VisitorsBridge.java:265)  
> at org.sonar.java.model.VisitorsBridge.runScanner(VisitorsBridge.java:260)  
> at org.sonar.java.model.VisitorsBridge.visitFile(VisitorsBridge.java:243)  
> at org.sonar.java.ast.JavaAstScanner.simpleScan(JavaAstScanner.java:132)  
> at org.sonar.java.JavaFrontend.scanAsBatchCallback(JavaFrontend.java:247)  
> at org.sonar.java.JavaFrontend.lambda$scanBatch$0(JavaFrontend.java:238)  
> at org.sonar.java.model.JParserConfig$Batch$1.acceptAST(JParserConfig.java:181)  
> at org.eclipse.jdt.core.dom.CompilationUnitResolver.resolve(CompilationUnitResolver.java:1143)  
> at org.eclipse.jdt.core.dom.CompilationUnitResolver.resolve(CompilationUnitResolver.java:739)  
> at org.eclipse.jdt.core.dom.ASTParser.createASTs(ASTParser.java:1049)  
> at org.sonar.java.model.JParserConfig$Batch.parse(JParserConfig.java:165)  
> at org.sonar.java.JavaFrontend.scanBatch(JavaFrontend.java:238)  
> at org.sonar.java.JavaFrontend.scanInBatches(JavaFrontend.java:228)  
> at org.sonar.java.JavaFrontend.scanAsBatch(JavaFrontend.java:195)  
> at org.sonar.java.JavaFrontend.scan(JavaFrontend.java:170)  
> at org.sonar.plugins.java.JavaSensor.execute(JavaSensor.java:113)  
> at org.sonar.scanner.sensor.AbstractSensorWrapper.analyse(AbstractSensorWrapper.java:64)  
> at org.sonar.scanner.sensor.ModuleSensorsExecutor.execute(ModuleSensorsExecutor.java:88)  
> at org.sonar.scanner.sensor.ModuleSensorsExecutor.lambda$execute$1(ModuleSensorsExecutor.java:61)  
> at org.sonar.scanner.sensor.ModuleSensorsExecutor.withModuleStrategy(ModuleSensorsExecutor.java:79)  
> at org.sonar.scanner.sensor.ModuleSensorsExecutor.execute(ModuleSensorsExecutor.java:61)  
> at org.sonar.scanner.scan.SpringModuleScanContainer.doAfterStart(SpringModuleScanContainer.java:82)  
> at org.sonar.core.platform.SpringComponentContainer.startComponents(SpringComponentContainer.java:188)  
> at org.sonar.core.platform.SpringComponentContainer.execute(SpringComponentContainer.java:167)  
> at org.sonar.scanner.scan.SpringProjectScanContainer.scan(SpringProjectScanContainer.java:403)  
> at org.sonar.scanner.scan.SpringProjectScanContainer.scanRecursively(SpringProjectScanContainer.java:399)  
> at org.sonar.scanner.scan.SpringProjectScanContainer.scanRecursively(SpringProjectScanContainer.java:396)  
> at org.sonar.scanner.scan.SpringProjectScanContainer.doAfterStart(SpringProjectScanContainer.java:368)  
> at org.sonar.core.platform.SpringComponentContainer.startComponents(SpringComponentContainer.java:188)  
> at org.sonar.core.platform.SpringComponentContainer.execute(SpringComponentContainer.java:167)  
> at org.sonar.scanner.bootstrap.SpringGlobalContainer.doAfterStart(SpringGlobalContainer.java:137)  
> at org.sonar.core.platform.SpringComponentContainer.startComponents(SpringComponentContainer.java:188)  
> at org.sonar.core.platform.SpringComponentContainer.execute(SpringComponentContainer.java:167)  
> at org.sonar.batch.bootstrapper.Batch.doExecute(Batch.java:72)  
> at org.sonar.batch.bootstrapper.Batch.execute(Batch.java:66)  
> at org.sonarsource.scanner.api.internal.batch.BatchIsolatedLauncher.execute(BatchIsolatedLauncher.java:46)  
> at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)  
> at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)  
> at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)  
> at java.base/java.lang.reflect.Method.invoke(Method.java:568)  
> at org.sonarsource.scanner.api.internal.IsolatedLauncherProxy.invoke(IsolatedLauncherProxy.java:60)  
> at jdk.proxy1/jdk.proxy1.$Proxy0.execute(Unknown Source)  
> at org.sonarsource.scanner.api.EmbeddedScanner.doExecute(EmbeddedScanner.java:189)  
> at org.sonarsource.scanner.api.EmbeddedScanner.execute(EmbeddedScanner.java:138)  
> at org.sonarsource.scanner.cli.Main.execute(Main.java:112)  
> at org.sonarsource.scanner.cli.Main.execute(Main.java:75)  
> at org.sonarsource.scanner.cli.Main.main(Main.java:61)
> 
> ERROR: Unable to run check class com.sonar.security.frontend.java.rules.ReflectedXssCheck - S5131 on file ‘path/to/Java.class’, To help improve the SonarSource Java Analyzer, please report this problem to SonarSource: see [https://community.sonarsource.com/](https://community.sonarsource.com/)  
> com.sonar.security.frontend.java.A: Cannot generate ucfg for file path/to/Java.class for method at line 166  
> at com.sonar.security.frontend.java.F.serializeUCFG(na:2414)  
> at com.sonar.security.frontend.java.F.visitMethod(na:1996)  
> at org.sonar.java.model.declaration.MethodTreeImpl.accept(MethodTreeImpl.java:231)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:34)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitClass(BaseTreeVisitor.java:70)  
> at com.sonar.security.frontend.java.F.visitClass(na:1845)  
> at org.sonar.java.model.declaration.ClassTreeImpl.accept(ClassTreeImpl.java:220)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:34)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitCompilationUnit(BaseTreeVisitor.java:52)  
> at org.sonar.java.model.JavaTree$CompilationUnitTreeImpl.accept(JavaTree.java:196)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at com.sonar.security.frontend.java.F.scanFile(na:1902)  
> at com.sonar.security.frontend.java.rules.A.scanFile(na:3426)  
> at org.sonar.java.model.VisitorsBridge.lambda$runScanner$1(VisitorsBridge.java:260)  
> at org.sonar.java.model.VisitorsBridge.runScanner(VisitorsBridge.java:265)  
> at org.sonar.java.model.VisitorsBridge.runScanner(VisitorsBridge.java:260)  
> at org.sonar.java.model.VisitorsBridge.visitFile(VisitorsBridge.java:243)  
> at org.sonar.java.ast.JavaAstScanner.simpleScan(JavaAstScanner.java:132)  
> at org.sonar.java.JavaFrontend.scanAsBatchCallback(JavaFrontend.java:247)  
> at org.sonar.java.JavaFrontend.lambda$scanBatch$0(JavaFrontend.java:238)  
> at org.sonar.java.model.JParserConfig$Batch$1.acceptAST(JParserConfig.java:181)  
> at org.eclipse.jdt.core.dom.CompilationUnitResolver.resolve(CompilationUnitResolver.java:1143)  
> at org.eclipse.jdt.core.dom.CompilationUnitResolver.resolve(CompilationUnitResolver.java:739)  
> at org.eclipse.jdt.core.dom.ASTParser.createASTs(ASTParser.java:1049)  
> at org.sonar.java.model.JParserConfig$Batch.parse(JParserConfig.java:165)  
> at org.sonar.java.JavaFrontend.scanBatch(JavaFrontend.java:238)  
> at org.sonar.java.JavaFrontend.scanInBatches(JavaFrontend.java:228)  
> at org.sonar.java.JavaFrontend.scanAsBatch(JavaFrontend.java:195)  
> at org.sonar.java.JavaFrontend.scan(JavaFrontend.java:170)  
> at org.sonar.plugins.java.JavaSensor.execute(JavaSensor.java:113)  
> at org.sonar.scanner.sensor.AbstractSensorWrapper.analyse(AbstractSensorWrapper.java:64)  
> at org.sonar.scanner.sensor.ModuleSensorsExecutor.execute(ModuleSensorsExecutor.java:88)  
> at org.sonar.scanner.sensor.ModuleSensorsExecutor.lambda$execute$1(ModuleSensorsExecutor.java:61)  
> at org.sonar.scanner.sensor.ModuleSensorsExecutor.withModuleStrategy(ModuleSensorsExecutor.java:79)  
> at org.sonar.scanner.sensor.ModuleSensorsExecutor.execute(ModuleSensorsExecutor.java:61)  
> at org.sonar.scanner.scan.SpringModuleScanContainer.doAfterStart(SpringModuleScanContainer.java:82)  
> at org.sonar.core.platform.SpringComponentContainer.startComponents(SpringComponentContainer.java:188)  
> at org.sonar.core.platform.SpringComponentContainer.execute(SpringComponentContainer.java:167)  
> at org.sonar.scanner.scan.SpringProjectScanContainer.scan(SpringProjectScanContainer.java:403)  
> at org.sonar.scanner.scan.SpringProjectScanContainer.scanRecursively(SpringProjectScanContainer.java:399)  
> at org.sonar.scanner.scan.SpringProjectScanContainer.scanRecursively(SpringProjectScanContainer.java:396)  
> at org.sonar.scanner.scan.SpringProjectScanContainer.doAfterStart(SpringProjectScanContainer.java:368)  
> at org.sonar.core.platform.SpringComponentContainer.startComponents(SpringComponentContainer.java:188)  
> at org.sonar.core.platform.SpringComponentContainer.execute(SpringComponentContainer.java:167)  
> at org.sonar.scanner.bootstrap.SpringGlobalContainer.doAfterStart(SpringGlobalContainer.java:137)  
> at org.sonar.core.platform.SpringComponentContainer.startComponents(SpringComponentContainer.java:188)  
> at org.sonar.core.platform.SpringComponentContainer.execute(SpringComponentContainer.java:167)  
> at org.sonar.batch.bootstrapper.Batch.doExecute(Batch.java:72)  
> at org.sonar.batch.bootstrapper.Batch.execute(Batch.java:66)  
> at org.sonarsource.scanner.api.internal.batch.BatchIsolatedLauncher.execute(BatchIsolatedLauncher.java:46)  
> at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)  
> at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)  
> at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)  
> at java.base/java.lang.reflect.Method.invoke(Method.java:568)  
> at org.sonarsource.scanner.api.internal.IsolatedLauncherProxy.invoke(IsolatedLauncherProxy.java:60)  
> at jdk.proxy1/jdk.proxy1.$Proxy0.execute(Unknown Source)  
> at org.sonarsource.scanner.api.EmbeddedScanner.doExecute(EmbeddedScanner.java:189)  
> at org.sonarsource.scanner.api.EmbeddedScanner.execute(EmbeddedScanner.java:138)  
> at org.sonarsource.scanner.cli.Main.execute(Main.java:112)  
> at org.sonarsource.scanner.cli.Main.execute(Main.java:75)  
> at org.sonarsource.scanner.cli.Main.main(Main.java:61)  
> Caused by: java.lang.NullPointerException: Cannot invoke “org.sonar.plugins.java.api.semantic.Symbol.type()” because “” is null  
> at com.sonar.security.frontend.java.N.A(na:2514)  
> at com.sonar.security.frontend.java.N.visitIdentifier(na:2184)  
> at org.sonar.java.model.expression.IdentifierTreeImpl.accept(IdentifierTreeImpl.java:98)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitContinueStatement(BaseTreeVisitor.java:181)  
> at org.sonar.java.model.statement.ContinueStatementTreeImpl.accept(ContinueStatementTreeImpl.java:72)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:34)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitBlock(BaseTreeVisitor.java:87)  
> at org.sonar.java.model.statement.BlockTreeImpl.accept(BlockTreeImpl.java:75)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitIfStatement(BaseTreeVisitor.java:109)  
> at org.sonar.java.model.statement.IfStatementTreeImpl.accept(IfStatementTreeImpl.java:103)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:34)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitBlock(BaseTreeVisitor.java:87)  
> at org.sonar.java.model.statement.BlockTreeImpl.accept(BlockTreeImpl.java:75)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitForEachStatement(BaseTreeVisitor.java:166)  
> at org.sonar.java.model.statement.ForEachStatementImpl.accept(ForEachStatementImpl.java:99)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:34)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitBlock(BaseTreeVisitor.java:87)  
> at org.sonar.java.model.statement.BlockTreeImpl.accept(BlockTreeImpl.java:75)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitForEachStatement(BaseTreeVisitor.java:166)  
> at org.sonar.java.model.statement.ForEachStatementImpl.accept(ForEachStatementImpl.java:99)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitLabeledStatement(BaseTreeVisitor.java:98)  
> at org.sonar.java.model.statement.LabeledStatementTreeImpl.accept(LabeledStatementTreeImpl.java:77)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:34)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitBlock(BaseTreeVisitor.java:87)  
> at org.sonar.java.model.statement.BlockTreeImpl.accept(BlockTreeImpl.java:75)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at com.sonar.security.frontend.java.N.visitLambdaExpression(na:355)  
> at org.sonar.java.model.expression.LambdaExpressionTreeImpl.accept(LambdaExpressionTreeImpl.java:100)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitReturnStatement(BaseTreeVisitor.java:186)  
> at org.sonar.java.model.statement.ReturnStatementTreeImpl.accept(ReturnStatementTreeImpl.java:70)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:34)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitBlock(BaseTreeVisitor.java:87)  
> at org.sonar.java.model.statement.BlockTreeImpl.accept(BlockTreeImpl.java:75)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.scan(BaseTreeVisitor.java:40)  
> at org.sonar.plugins.java.api.tree.BaseTreeVisitor.visitMethod(BaseTreeVisitor.java:82)  
> at org.sonar.java.model.declaration.MethodTreeImpl.accept(MethodTreeImpl.java:231)  
> at com.sonar.security.frontend.java.F.buildUCfg(na:2144)  
> at com.sonar.security.frontend.java.F.serializeUCFG(na:675)  
> … 62 common frames omitted

I’m sorry I can’t provide a minimal example at the moment.

Version information :

- Data Center Edition
- Version 9.9 (build 65466)

Thanks & regards,  
Nicolas.

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [October 25, 2023, 9:44am UTC](https://community.sonarsource.com/t/nullpointerexception-in-sonar-scanner-with-rule-reflectedxsscheck/103237/2 "2023-10-25T09:44:43Z")

</div>

Hey there.

> [@Nicolas\_Baumann](#):
>
> Version information :
> 
> - Data Center Edition

If that’s the version you’re licensed for, then you have access to our professional support engineers. They have actual SLAs, you can proivde code/logs confidentially… get in touch with your SonarQube administrators if you don’t have access.

---

<div class="post-metadata">

**Author:** ![Nicolas\_Baumann](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/nicolas_baumann/32/72625_2.png) [@Nicolas\_Baumann](https://community.sonarsource.com/u/Nicolas_Baumann)\
**Post date:** [October 25, 2023, 12:42pm UTC](https://community.sonarsource.com/t/nullpointerexception-in-sonar-scanner-with-rule-reflectedxsscheck/103237/3 "2023-10-25T12:42:20Z")

</div>

Hello,

Thanks for the info, I’m getting in touch.  
That message invited me to report here:

> To help improve the SonarSource Java Analyzer, please report this problem to SonarSource: see [https://community.sonarsource.com/](https://community.sonarsource.com/)

Thanks & regards,  
Nicolas.