obj can be None, but not checked.

[jensens]

The result of unrestrictedTraverse might be None. But the code does not check it. If for some reason the path is wrong the code fails:

plone.exportimport/src/plone/exportimport/utils/content/core.py

Lines 62 to 64 in cfeccda

	obj = portal.unrestrictedTraverse(path, default=None)
	# Check if the found object has the expected uid
	obj = obj if api.content.get_uuid(obj) == uid else None

2026-04-20 14:27:38,634 ERROR   [Zope.SiteErrorLog:35][waitress-3] MissingParameterError: http://localhost:8080/@sites
Traceback (innermost last):
  Module ZPublisher.WSGIPublisher, line 181, in transaction_pubevents
  Module ZPublisher.WSGIPublisher, line 390, in publish_module
  Module ZPublisher.WSGIPublisher, line 284, in publish
  Module ZPublisher.mapply, line 98, in mapply
  Module ZPublisher.WSGIPublisher, line 68, in call_object
  Module plone.rest.service, line 21, in __call__
  Module plone.restapi.services, line 19, in render
  Module plone.distribution.services.sites.add, line 49, in reply
  Module plone.distribution.api.site, line 165, in create
  Module plone.distribution.api.site, line 104, in _create_site
  Module plone.distribution.handler, line 44, in default_handler
  Module plone.exportimport.importers, line 59, in import_site
  Module plone.exportimport.importers.content, line 204, in import_data
  Module plone.exportimport.importers.base, line 88, in import_data
  Module plone.exportimport.importers.content, line 164, in do_import
  Module plone.exportimport.utils.content.import_helpers, line 333, in set_ordering
  Module plone.exportimport.utils.content.core, line 64, in object_from_uid_or_path
  Module decorator, line 235, in fun
  Module plone.api.validation, line 67, in wrapped
plone.api.exc.MissingParameterError: Missing required parameter(s): obj

In the other failure path the function returns None - this should be the case here too.

[jensens]

Ran into this again with plone.exportimport 1.3.1 (pinned by Plone 6.1.4) during plone.distribution site creation, and tracked down what makes the path lookup fail in the first place:

The distribution content contained a Document with id image inside another Document. During import, unrestrictedTraverse on the recorded path returns None because the child id is shadowed by the image field of the plone.leadimage behavior — with an active site, Dexterity __getattr__ resolves schema/behavior field defaults before BTree children. Any content id equal to a behavior field name of its parent's type triggers this (image, preview_image, text, ...).

The catalog fallback in object_from_uid cannot compensate either: at metadata-setter time the UID index still holds the auto-generated UID from object construction; the imported UID is only reindexed later.

So both lookups legitimately fail and object_from_uid_or_path should return None — callers like set_ordering already handle that gracefully ("Could not find object to set ordering") — instead of crashing in api.content.get_uuid(None):

obj = portal.unrestrictedTraverse(path, default=None)
if obj is None or api.content.get_uuid(obj) != uid:
    obj = None

Verified the crash is deterministic on a fresh site create and that the guard lets the import complete. Still present on current main (2.x line).