Skip credential decryption when the IV is missing

decryptAPIRestCredentials bailed only when the ciphertext columns were empty; a row
with ciphertext but a blank IV would reach decrypt(ciphertext, "") and throw on read.
Also short-circuit when either IV is empty, treating the malformed row as having no
credentials.

Author: jkmassel

libs/fluxc/src/main/java/org/wordpress/android/fluxc/persistence/SiteSqlUtils.kt

@@ -708,14 +708,17 @@ class SiteSqlUtils
         return this.map { it.decryptAPIRestCredentials() }
     }
 
-    @Suppress("ReturnCount")
+    @Suppress("ReturnCount", "ComplexCondition")
     private fun SiteModel.decryptAPIRestCredentials(): SiteModel {
         // If already decrypted, do nothing
         if (!apiRestUsernamePlain.isNullOrEmpty() && !apiRestPasswordPlain.isNullOrEmpty()) {
             return this
         }
-        // If the encrypted credentials are empty, there's nothing to decrypt
-        if (apiRestUsernameEncrypted.isNullOrEmpty() || apiRestPasswordEncrypted.isNullOrEmpty()) {
+        // If the encrypted credentials — or the IVs required to decrypt them — are empty, there's nothing to
+        // safely decrypt. The ciphertext/IV pairs are always written together, so a row missing any one is
+        // treated as having no decryptable credentials rather than risking a decrypt failure on a blank IV.
+        if (apiRestUsernameEncrypted.isNullOrEmpty() || apiRestPasswordEncrypted.isNullOrEmpty() ||
+            apiRestUsernameIV.isNullOrEmpty() || apiRestPasswordIV.isNullOrEmpty()) {
             return this
         }
         apiRestUsernamePlain = encryptionUtils.decrypt(apiRestUsernameEncrypted, apiRestUsernameIV)

libs/fluxc/src/test/java/org/wordpress/android/fluxc/persistence/SiteSqlUtilsTest.kt

@@ -191,6 +191,25 @@ class SiteSqlUtilsTest {
         assertThat(stored.apiRestPasswordIV).isEmpty()
     }
 
+    @Test
+    fun `reading a site with credential ciphertext but a blank IV does not attempt decryption`() {
+        // A row carrying credential ciphertext without its IV is malformed — decrypting it would fail. The
+        // read path must treat it as having no decryptable credentials instead of throwing. Both ciphertexts
+        // are present here so only the blank-IV guard (not the empty-ciphertext one) can short-circuit.
+        WellSql.insert(SiteModel().apply {
+            url = "https://example.test"
+            apiRestUsernameEncrypted = "enc_user"
+            apiRestUsernameIV = ""
+            apiRestPasswordEncrypted = "enc_pass"
+            apiRestPasswordIV = "iv_pass"
+        }).execute()
+
+        val stored = siteSqlUtils.getSites().single()
+
+        assertThat(stored.apiRestUsernamePlain).isNullOrEmpty()
+        assertThat(stored.apiRestPasswordPlain).isNullOrEmpty()
+    }
+
     @Test
     fun `updateXmlRpcUrl writes the column and leaves other fields alone`() {
         WellSql.insert(SiteModel().apply {