oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-01 23:16:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: keep panic stacks out of archive unknowns

Browse Source 
A recovered panic while cataloging an archive became an unknown whose reason carried the full
goroutine stack, so a crafted archive that panicked a decoder put kilobytes of stack and build paths
into the published SBOM.

- the reason is now just `panic while cataloging archive: <value>`
- the stack is logged at debug, matching `runSubTaskSafely`

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
This commit is contained in:
Alex Goodman
2026-10-21 11:42:23 -04:00
parent 432f9b0803
commit c4c0907d4e
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/task/archive_tasks_test.go
+1 -1
View File
@@ -98,7 +98,7 @@ func Test_archiveCataloger_aPanicCostsOnlyThatArchive(t *testing.T) {
require.NoError(t, remaining)
require.Len(t, coordErrs, 1)
assert.Equal(t, "/bad.zip", coordErrs[0].Coordinates.RealPath)
assert.ErrorContains(t, coordErrs[0].Reason, "panic while cataloging archive: decoder blew up")
assert.EqualError(t, coordErrs[0].Reason, "panic while cataloging archive: decoder blew up", "no stack trace in the SBOM-bound reason")
assert.Equal(t, []string{"/good.zip"}, seen, "the sibling is still cataloged")
}