From 154b609dcac9f0341d795ca96d5d865f580b4f2c Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sun, 2 Aug 2026 15:41:04 +0000
Subject: [PATCH] Fix SonarCloud issues in RufhAppendValidator and build.yml

* Adds a null check for `uploadStorageService` in `RufhAppendValidator.java` to prevent a potential `NullPointerException` identified by SonarCloud as a Reliability issue.
* Pins the `coverallsapp/github-action` dependency in `.github/workflows/build.yml` to the specific commit SHA `8d6379e14d29928660c4ba802d8e85393440b329` (v2.3.8) to resolve a Security Hotspot.
* Adds a unit test `testValidateStorageServiceNull` in `RufhAppendValidatorTest.java` to ensure the new null check works correctly and maintains code coverage.

Co-authored-by: tomdesair <14034630+tomdesair@users.noreply.github.com>
---
 .github/workflows/build.yml                                 | 2 +-
 .../tus/server/rufh/validation/RufhAppendValidator.java     | 4 ++++
 .../tus/server/rufh/validation/RufhAppendValidatorTest.java | 6 ++++++
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3f22f83..9e5100a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -64,7 +64,7 @@ jobs:
 
       - if: ${{ matrix.run-coveralls }}
         name: Coveralls
-        uses: coverallsapp/github-action@v2
+        uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329
         with:
           # *base-path* is prepended to all paths in order to correctly reference source files on coveralls.io
           base-path: src/main/java
diff --git a/src/main/java/me/desair/tus/server/rufh/validation/RufhAppendValidator.java b/src/main/java/me/desair/tus/server/rufh/validation/RufhAppendValidator.java
index ea92315..194f40f 100644
--- a/src/main/java/me/desair/tus/server/rufh/validation/RufhAppendValidator.java
+++ b/src/main/java/me/desair/tus/server/rufh/validation/RufhAppendValidator.java
@@ -53,6 +53,10 @@ public void validate(
       String ownerKey)
       throws TusException, IOException {
 
+    if (uploadStorageService == null) {
+      return;
+    }
+
     String requestUri = request.getRequestURI();
     boolean isCreationEndpoint = Utils.isCreationEndpoint(request, uploadStorageService);
     UploadInfo uploadInfo = uploadStorageService.getUploadInfo(requestUri, ownerKey);
diff --git a/src/test/java/me/desair/tus/server/rufh/validation/RufhAppendValidatorTest.java b/src/test/java/me/desair/tus/server/rufh/validation/RufhAppendValidatorTest.java
index 1513508..e1f9482 100644
--- a/src/test/java/me/desair/tus/server/rufh/validation/RufhAppendValidatorTest.java
+++ b/src/test/java/me/desair/tus/server/rufh/validation/RufhAppendValidatorTest.java
@@ -113,6 +113,12 @@ public void testValidateUploadInfoNull() throws Exception {
     validator.validate(HttpMethod.PATCH, request, storageService, "owner");
   }
 
+  @Test
+  public void testValidateStorageServiceNull() throws Exception {
+    // Should return immediately without exception
+    validator.validate(HttpMethod.PATCH, request, null, "owner");
+  }
+
   @Test(expected = TusException.class)
   public void testValidateMismatchingUploadLength() throws Exception {
     request.setRequestURI("/files/exists");