gocsaf / csaf

Tools to download or provide CSAF (Common Security Advisory Framework) documents.
https://csaf.io
42 stars 25 forks source link

Fix pmd crash #370

Closed JanHoefelmeyer closed 1 year ago

JanHoefelmeyer commented 1 year ago

Currently, trying to check an invalid provider-metadata.json leads to a crash. (It causes a nullpointerreference when ranging over *domain.Role in line 250 of csaf_checker/processor.go):

for _, r := range buildReporters(*domain.Role) {
    r.report(p, domain)
}

This PR adds logging output that the provider-metadata.json of that domain couldn't be parsed and then continues onto the next domain instead of trying to build relevant reporters.

This should also address https://github.com/csaf-poc/csaf_distribution/issues/251

JanHoefelmeyer commented 1 year ago

Since reporters are build based off of the provider-metadata.json, which in turn is not avaible if all lookup methods fail, this PR already solves most of https://github.com/csaf-poc/csaf_distribution/issues/305. All thats left is to give out a warning instead of an error should any singular lookup method not be done, which is the content of https://github.com/csaf-poc/csaf_distribution/pull/370/commits/c3ef8e604c813bb65385b0e1dbbc7d7c85c63096. As such, this PR should also solve https://github.com/csaf-poc/csaf_distribution/issues/305

bernhard-herzog commented 1 year ago

LGTM. I tested that the segmentation violation does indeed not occur anymore and the code produces a suitable log message instead