From c4c0907d4e59867da3e0d404e25721293508bad8 Mon Sep 17 00:00:00 2001 From: Alex Goodman Date: Wed, 21 Oct 2026 11:42:23 -0400 Subject: [PATCH] fix: keep panic stacks out of archive unknowns A recovered panic while cataloging an archive became an unknown whose reason carried the full goroutine stack, so a crafted archive that panicked a decoder put kilobytes of stack and build paths into the published SBOM. - the reason is now just `panic while cataloging archive: ` - the stack is logged at debug, matching `runSubTaskSafely` Signed-off-by: Alex Goodman --- internal/task/archive_tasks.go | 4 +++- internal/task/archive_tasks_test.go | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/internal/task/archive_tasks.go b/internal/task/archive_tasks.go index 7ae84f1aa..cba96c993 100644 --- a/internal/task/archive_tasks.go +++ b/internal/task/archive_tasks.go @@ -181,7 +181,9 @@ func (c *archiveCataloger) processArchive(ctx context.Context, parentResolver fi // the decoders run on untrusted bytes; a panic in one costs this archive, not the scan defer func() { if r := recover(); r != nil { - err = fmt.Errorf("panic while cataloging archive: %v at:\n%s", r, debug.Stack()) + // the stack goes to the log, not the reason: the reason lands in the published SBOM's unknowns + log.WithFields("path", candidate.location.FullNestedPath()).Debugf("archive cataloging panic stack:\n%s", debug.Stack()) + err = fmt.Errorf("panic while cataloging archive: %v", r) } }() diff --git a/internal/task/archive_tasks_test.go b/internal/task/archive_tasks_test.go index cbdd9bdce..e4932b835 100644 --- a/internal/task/archive_tasks_test.go +++ b/internal/task/archive_tasks_test.go @@ -98,7 +98,7 @@ func Test_archiveCataloger_aPanicCostsOnlyThatArchive(t *testing.T) { require.NoError(t, remaining) require.Len(t, coordErrs, 1) assert.Equal(t, "/bad.zip", coordErrs[0].Coordinates.RealPath) - assert.ErrorContains(t, coordErrs[0].Reason, "panic while cataloging archive: decoder blew up") + assert.EqualError(t, coordErrs[0].Reason, "panic while cataloging archive: decoder blew up", "no stack trace in the SBOM-bound reason") assert.Equal(t, []string{"/good.zip"}, seen, "the sibling is still cataloged") }