Fix nil pointer panics in GitHub analyzer gist/repo binding functions#4864
Open
shahzadhaider1 wants to merge 3 commits intotrufflesecurity:mainfrom
Open
Fix nil pointer panics in GitHub analyzer gist/repo binding functions#4864shahzadhaider1 wants to merge 3 commits intotrufflesecurity:mainfrom
shahzadhaider1 wants to merge 3 commits intotrufflesecurity:mainfrom
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
MuneebUllahKhan222
approved these changes
Apr 6, 2026
Contributor
MuneebUllahKhan222
left a comment
MuneebUllahKhan222
left a comment
There was a problem hiding this comment.
LGTM! Just one small comment that we should think over
| for _, repo := range repos { | ||
| // A repo without an owner cannot be attributed; skip it rather than | ||
| // producing a corrupt parent resource with empty name/FQN. | ||
| if repo.GetOwner() == nil { |
Contributor
There was a problem hiding this comment.
Skipping a repo resource just because we don't know about it's owner doesn't seem right to me. Maybe we should set the parent resource as nil for such cases.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A panic was caught in the GitHub analyzer worker:
The GitHub API returns
descriptionandowneras optional nullable fields on gist objects. When a gist has no description, the API returnsnull, leavingDescriptionas a nil*string. The code dereferenced it directly (*gist.Description) without any nil guard.The same class of bug existed across several functions in the file:
*gist.Owner.Login,*gist.ID,*repo.Name,*repo.FullName,*user.Login,*user.Type; all raw dereferences of fields that the go-github library defines as optional pointers.Why safe getters alone weren't enough for
OwnerFor
Description, replacing the dereference withGetDescription()(returns""on nil) is sufficient, a gist without a description is still attributable.For
Owner, falling back to an empty string silently produces corrupt output:FullyQualifiedName: "gist.github.com//abc123": malformedParentresource with emptyNameandTypeA gist with no owner cannot be meaningfully attributed, so it is skipped rather than emitting bad data. This is consistent with how
PrintGistsincommon/github.goalready handles nil gist pointers.Checklist:
make test-community)?make lintthis requires golangci-lint)?Note
Low Risk
Low risk: changes are defensive nil-handling in binding construction and add unit tests; behavior only differs for malformed/partial GitHub API responses (now skipped instead of panicking or emitting corrupt FQNs).
Overview
Fixes GitHub analyzer binding generation to avoid nil-pointer panics by replacing direct pointer dereferences with go-github safe getters in
userToResource,secretInfoToRepoBindings, andsecretInfoToGistBindings.Adds guards to skip repos/gists with a nil
Owner(preventing corrupt parent resources/FQNs), and introduces a focused unit test covering gist nilDescriptionand nilOwneredge cases.Reviewed by Cursor Bugbot for commit cc21483. Bugbot is set up for automated code reviews on this repo. Configure here.