From fd95a94654eac6447cb1c0a7b75e208715da7b52 Mon Sep 17 00:00:00 2001
From: Neil Donewar <ndonewar@sonatype.com>
Date: Fri, 8 Oct 2021 14:33:01 -0400
Subject: [PATCH] Ensure getExternalReferences() will never return null (#30)

---
 .../api/componentreport/ComponentReportVulnerability.java     | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/api/src/main/java/org/sonatype/ossindex/service/api/componentreport/ComponentReportVulnerability.java b/api/src/main/java/org/sonatype/ossindex/service/api/componentreport/ComponentReportVulnerability.java
index 6d2bc62..b4d6f03 100644
--- a/api/src/main/java/org/sonatype/ossindex/service/api/componentreport/ComponentReportVulnerability.java
+++ b/api/src/main/java/org/sonatype/ossindex/service/api/componentreport/ComponentReportVulnerability.java
@@ -14,6 +14,7 @@
 
 import java.io.Serializable;
 import java.net.URI;
+import java.util.ArrayList;
 import java.util.List;
 import java.util.Objects;
 
@@ -212,6 +213,9 @@ public void setVersionRanges(@Nullable final List<String> versionRanges) {
    * @since 1.8.0
    */
   public List<URI> getExternalReferences() {
+    if (externalReferences == null) {
+      externalReferences = new ArrayList<>();
+    }
     return externalReferences;
   }