Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

false positive with loop #170

Open
mpldr opened this issue Jan 11, 2024 · 2 comments
Open

false positive with loop #170

mpldr opened this issue Jan 11, 2024 · 2 comments
Labels
needs triaging Requires triaging by the maintainers

Comments

@mpldr
Copy link

mpldr commented Jan 11, 2024

	var file *http.Response
	for _, url := range urlsToTry {
		file, err = http.Get(url)
		if err == nil {
			break
		}
	}
	if err != nil {
		return nil, fmt.Errorf("failed to get config: %w", err)
	}

	cfg := &wellKnownFile{}
	err = json.NewDecoder(file.Body).Decode(cfg)
	if err != nil {
		return nil, fmt.Errorf("failed to parse config: %w", err)
	}
/home/moritz/Projects/oidc/configuration.go:63:24: error: Potential nil panic detected. Observed nil flow from source to dereference point: 
	-> http/client.go:644:12: unassigned variable `resp` returned from `do()` in position 0
	-> http/client.go:590:9: result 0 of `do()` returned from `Do()` in position 0
	-> http/client.go:488:9: result 0 of `Do()` returned from `Get()` in position 0
	-> http/client.go:457:9: result 0 of `Get()` returned from `Get()` in position 0
	-> oidc/configuration.go:63:24: result 0 of `Get()` accessed field `Body`

err = json.NewDecoder(file.Body).Decode(cfg) is (to my understanding) well-guarded.

@sonalmahajan15 sonalmahajan15 added the needs triaging Requires triaging by the maintainers label Jan 12, 2024
@napkindrawing
Copy link

I believe the submitter is incorrect, if urlsToTry is empty and the loop body never executes, then file is never assigned.

@mpldr
Copy link
Author

mpldr commented Feb 6, 2024

Sorry, I should have clarified: urlsToTry is always set to have two elements. Both of which are guaranteed to be valid URLs through the url.URL type. But even if that was possible, the trace would be wrong for that case.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs triaging Requires triaging by the maintainers
Projects
None yet
Development

No branches or pull requests

3 participants