oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-02 07:26:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: keep panic stacks out of archive unknowns

Browse Source 
A recovered panic while cataloging an archive became an unknown whose reason carried the full
goroutine stack, so a crafted archive that panicked a decoder put kilobytes of stack and build paths
into the published SBOM.

- the reason is now just `panic while cataloging archive: <value>`
- the stack is logged at debug, matching `runSubTaskSafely`

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
This commit is contained in:
Alex Goodman
2026-10-21 11:42:23 -04:00
parent 432f9b0803
commit c4c0907d4e
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/task/archive_tasks.go
+3 -1
View File
@@ -181,7 +181,9 @@ func (c *archiveCataloger) processArchive(ctx context.Context, parentResolver fi
// the decoders run on untrusted bytes; a panic in one costs this archive, not the scan // the decoders run on untrusted bytes; a panic in one costs this archive, not the scan
defer func() { defer func() {
if r := recover(); r != nil { if r := recover(); r != nil {
err = fmt.Errorf("panic while cataloging archive: %v at:\n%s", r, debug.Stack()) // the stack goes to the log, not the reason: the reason lands in the published SBOM's unknowns
log.WithFields("path", candidate.location.FullNestedPath()).Debugf("archive cataloging panic stack:\n%s", debug.Stack())
err = fmt.Errorf("panic while cataloging archive: %v", r)
} }
}() }()
internal/task/archive_tasks_test.go
+1 -1
View File
@@ -98,7 +98,7 @@ func Test_archiveCataloger_aPanicCostsOnlyThatArchive(t *testing.T) {
require.NoError(t, remaining) require.NoError(t, remaining)
require.Len(t, coordErrs, 1) require.Len(t, coordErrs, 1)
assert.Equal(t, "/bad.zip", coordErrs[0].Coordinates.RealPath) assert.Equal(t, "/bad.zip", coordErrs[0].Coordinates.RealPath)
assert.ErrorContains(t, coordErrs[0].Reason, "panic while cataloging archive: decoder blew up") assert.EqualError(t, coordErrs[0].Reason, "panic while cataloging archive: decoder blew up", "no stack trace in the SBOM-bound reason")
assert.Equal(t, []string{"/good.zip"}, seen, "the sibling is still cataloged") assert.Equal(t, []string{"/good.zip"}, seen, "the sibling is still cataloged")
} }