fix(cosmossdk): guard nil cursor state in tx history pagination#1277
fix(cosmossdk): guard nil cursor state in tx history pagination#12770xApotheosis wants to merge 1 commit into
Conversation
A caller-controlled `cursor` is unmarshalled into the server-initialized pagination state. json.Unmarshal into the existing State map keeps unexpected keys and turns a JSON null value into a nil *CursorState, which filterByCursor then dereferences inside an errgroup worker goroutine. That panic is outside the net/http handler goroutine, so it isn't recovered and crashes the process. - Cursor.Decode drops nil state entries left by a malformed cursor. - filterByCursor skips nil state entries defensively. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughTwo complementary nil-safety fixes address cursor state handling: ChangesCursor state nil safety
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go/shared/cosmossdk/cursor.go`:
- Around line 43-50: The loop in cursor.go that deletes nil entries from c.State
causes missing keys and can lead to nil-pointer dereferences later (e.g.,
history.Cursor.State[source].Page in tx.go); instead of delete(c.State, source)
replace nil values with a non-nil default (e.g., c.State[source] =
&CursorState{} or an equivalent zero-value CursorState) so the key remains
present but safe to dereference; update the loop that iterates c.State to assign
a default CursorState when state == nil.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 10c2a88a-c706-4acf-a937-072caf8be4b5
📒 Files selected for processing (2)
go/shared/cosmossdk/cursor.gogo/shared/cosmossdk/history.go
| // json.Unmarshal into the existing State map keeps caller-supplied keys and stores a JSON | ||
| // null pointer value as a nil *CursorState. Drop those nil entries so a malformed cursor | ||
| // (e.g. {"state":{"x":null}}) can't leave a nil pointer to be dereferenced downstream. | ||
| for source, state := range c.State { | ||
| if state == nil { | ||
| delete(c.State, source) | ||
| } | ||
| } |
There was a problem hiding this comment.
Deleting nil entries can still leave a nil-deref path for expected sources.
At Line 48, deleting c.State[source] removes the initialized entry entirely. In go/shared/cosmossdk/tx.go (context snippet, source-page sync loop), history.Cursor.State[source].Page is dereferenced without an existence check after Decode; a cursor like {"state":{"<expected_source>":null}} can still panic there.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go/shared/cosmossdk/cursor.go` around lines 43 - 50, The loop in cursor.go
that deletes nil entries from c.State causes missing keys and can lead to
nil-pointer dereferences later (e.g., history.Cursor.State[source].Page in
tx.go); instead of delete(c.State, source) replace nil values with a non-nil
default (e.g., c.State[source] = &CursorState{} or an equivalent zero-value
CursorState) so the key remains present but safe to dereference; update the loop
that iterates c.State to assign a default CursorState when state == nil.
|
Superseded by #1279 (branch renamed). |
1 participant
Description
A caller-supplied
cursoris unmarshalled into the server-initialized pagination state.json.Unmarshalinto the existingStatemap keeps unexpected keys and stores a JSONnullvalue as a nil*CursorState.filterByCursorthen iteratesCursor.Stateand dereferences each entry, so a cursor carrying a null state value hits a nil pointer. That dereference runs in anerrgroupworker goroutine, so the panic isn't recovered by the request handler and takes down the process instead of just failing the one request.Cursor.Decodedrops nil*CursorStateentries left by a malformed cursor.filterByCursorskips nil entries defensively.Verification
Didn't run
go build/tests locally per the repo CLAUDE.md (CI handles build validation). It's a nil check plus dropping nil map values; no behaviour change on well-formed cursors.