search

ossillate-inc / packj

Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain
https://packj.dev
GNU Affero General Public License v3.0
648 stars 36 forks source link

Unitialised variable returned by `analyze_repo_activity` #95

Closed KyeRussell closed 7 months ago

KyeRussell commented 8 months ago

As seen here: https://github.com/ossillate-inc/packj/blob/0b1d39118539e7c13dd5a7941da11948a46534af/packj/audit/main.py#L454-L470

analyze_repo_activity()'s return value is determined by the finally: block on line 470. finally: runs regardless of the success of running the associated try:.

repo_data is set in line 458: https://github.com/ossillate-inc/packj/blob/0b1d39118539e7c13dd5a7941da11948a46534af/packj/audit/main.py#L458-L459

So you can end up with:

[+]    Checking repo activity...............FAIL [[Errno 24] Too many open files: '/var/folders/45/ssw660y51fv24md76zh0w2600000gn/T/clone-_lolhhw7/django-axes/axes/locale/pl/LC_MESSAGES']
local variable 'repo_data' referenced before assignment

Obviously the git_clone call failing (output: 'Too many open files') is the underlying issue, but analyze_repo_activity()'s behaviour is a bad smell + results in extra output that may confuse some users.

ashishbijlani commented 8 months ago

Thanks for reporting! I've created a PR: https://github.com/ossillate-inc/packj/pull/97 Would appreciate if you could review.

ashishbijlani commented 7 months ago

Fixed by https://github.com/ossillate-inc/packj/pull/97