Add additional guardrails and checks against nil pointers; clean up some confusing code as well (#1063)

egibs · web-flow · commit 37802b191382 · 2025-07-29T15:49:17.000Z
* [WIP] pass file contents by reference; add more nil checks

Signed-off-by: egibs &lt;20933572+egibs@users.noreply.github.com&gt;

* More improvements to report and strings.go

Signed-off-by: egibs &lt;20933572+egibs@users.noreply.github.com&gt;

* Add another length check for terminal output

Signed-off-by: egibs &lt;20933572+egibs@users.noreply.github.com&gt;

* More cleanup

Signed-off-by: egibs &lt;20933572+egibs@users.noreply.github.com&gt;

* More cleaup and consolidation

Signed-off-by: egibs &lt;20933572+egibs@users.noreply.github.com&gt;

* Small tweaks

Signed-off-by: egibs &lt;20933572+egibs@users.noreply.github.com&gt;

* Update third-party src assignment

Signed-off-by: egibs &lt;20933572+egibs@users.noreply.github.com&gt;

* Clean up hex key conditional

Signed-off-by: egibs &lt;20933572+egibs@users.noreply.github.com&gt;

---------

Signed-off-by: egibs &lt;20933572+egibs@users.noreply.github.com&gt;
diff --git a/pkg/action/diff.go b/pkg/action/diff.go
@@ -60,7 +60,9 @@ func relPath(from string, fr *malcontent.FileReport, isArchive bool, isImage boo
 		from = fr.Path
 		if strings.Contains(fr.Path, "∴") {
 			parts := strings.Split(fr.Path, "∴")
-			from = strings.TrimSpace(parts[0])
+			if len(parts) > 0 {
+				from = strings.TrimSpace(parts[0])
+			}
 		}
 		base, err = filepath.Abs(from)
 		if err != nil {
diff --git a/pkg/action/scan.go b/pkg/action/scan.go
@@ -167,9 +167,7 @@ func scanSinglePath(ctx context.Context, c malcontent.Config, path string, ruleF
 	initializeOnce.Do(func() {
 		scannerPool = pool.NewScannerPool(yrs, getMaxConcurrency(c.Concurrency))
 	})
-
-	scanner := scannerPool.Get()
-	defer scannerPool.Put(scanner)
+	scanner := scannerPool.Get(yrs)
 
 	fc, mrs, size, checksum, err := scanFD(scanner, fd, logger)
 	if err != nil {
@@ -195,6 +193,7 @@ func scanSinglePath(ctx context.Context, c malcontent.Config, path string, ruleF
 	}
 
 	defer func() {
+		scannerPool.Put(scanner)
 		fc = nil
 		mrs = nil
 	}()
@@ -788,20 +787,22 @@ func Scan(ctx context.Context, c malcontent.Config) (*malcontent.Report, error)
 		return r, err
 	}
 
-	r.Files.Range(func(key, value any) bool {
-		if scanCtx.Err() != nil {
-			return false
-		}
-		if key == nil || value == nil {
-			return true
-		}
-		if fr, ok := value.(*malcontent.FileReport); ok {
-			if fr.RiskScore < c.MinFileRisk {
-				r.Files.Delete(key)
+	if r != nil {
+		r.Files.Range(func(key, value any) bool {
+			if scanCtx.Err() != nil {
+				return false
 			}
-		}
-		return true
-	})
+			if key == nil || value == nil {
+				return true
+			}
+			if fr, ok := value.(*malcontent.FileReport); ok {
+				if fr.RiskScore < c.MinFileRisk {
+					r.Files.Delete(key)
+				}
+			}
+			return true
+		})
+	}
 	if scanCtx.Err() == nil && c.Stats && c.Renderer.Name() != "JSON" && c.Renderer.Name() != "YAML" {
 		err = render.Statistics(&c, r)
 		if err != nil {
diff --git a/pkg/archive/archive.go b/pkg/archive/archive.go
@@ -244,7 +244,7 @@ func handleDirectory(target string) error {
 
 // handleFile extracts valid files within .deb or .tar archives.
 func handleFile(target string, tr *tar.Reader) error {
-	buf := tarPool.Get(extractBuffer)
+	buf := tarPool.Get(extractBuffer) //nolint:nilaway // the buffer pool is created above
 	defer tarPool.Put(buf)
 
 	if err := os.MkdirAll(filepath.Dir(target), 0o700); err != nil {
diff --git a/pkg/archive/bz2.go b/pkg/archive/bz2.go
@@ -31,7 +31,7 @@ func ExtractBz2(ctx context.Context, d, f string) error {
 		return nil
 	}
 
-	buf := archivePool.Get(extractBuffer)
+	buf := archivePool.Get(extractBuffer) //nolint:nilaway // the buffer pool is created in archive.go
 
 	tf, err := os.Open(f)
 	if err != nil {
diff --git a/pkg/archive/gzip.go b/pkg/archive/gzip.go
@@ -53,7 +53,7 @@ func ExtractGzip(ctx context.Context, d string, f string) error {
 		return nil
 	}
 
-	buf := archivePool.Get(extractBuffer)
+	buf := archivePool.Get(extractBuffer) //nolint:nilaway // the buffer pool is created in archive.go
 
 	gf, err := os.Open(f)
 	if err != nil {
diff --git a/pkg/archive/rpm.go b/pkg/archive/rpm.go
@@ -40,7 +40,7 @@ func ExtractRPM(ctx context.Context, d, f string) error {
 		return nil
 	}
 
-	buf := archivePool.Get(extractBuffer)
+	buf := archivePool.Get(extractBuffer) //nolint:nilaway // the buffer pool is created in archive.go
 	defer archivePool.Put(buf)
 
 	pkg, err := rpm.Read(rpmFile)
diff --git a/pkg/archive/tar.go b/pkg/archive/tar.go
@@ -48,7 +48,7 @@ func ExtractTar(ctx context.Context, d string, f string) error {
 		return nil
 	}
 
-	buf := tarPool.Get(extractBuffer)
+	buf := tarPool.Get(extractBuffer) //nolint:nilaway // the buffer pool is created in archive.go
 
 	filename := filepath.Base(f)
 	tf, err := os.Open(f)
diff --git a/pkg/archive/zip.go b/pkg/archive/zip.go
@@ -123,7 +123,7 @@ func extractFile(ctx context.Context, file *zip.File, destDir string, logger *cl
 		}
 	}
 
-	buf := zipPool.Get(zipBuffer)
+	buf := zipPool.Get(zipBuffer) //nolint:nilaway // the buffer pool is created in archive.go
 
 	clean := filepath.Clean(filepath.ToSlash(file.Name))
 	if strings.Contains(clean, "..") {
diff --git a/pkg/archive/zlib.go b/pkg/archive/zlib.go
@@ -30,7 +30,7 @@ func ExtractZlib(ctx context.Context, d string, f string) error {
 		return nil
 	}
 
-	buf := archivePool.Get(extractBuffer)
+	buf := archivePool.Get(extractBuffer) //nolint:nilaway // the buffer pool is created in archive.go
 	defer archivePool.Put(buf)
 
 	zf, err := os.Open(f)
diff --git a/pkg/archive/zstd.go b/pkg/archive/zstd.go
@@ -30,7 +30,7 @@ func ExtractZstd(ctx context.Context, d string, f string) error {
 		return nil
 	}
 
-	buf := archivePool.Get(extractBuffer)
+	buf := archivePool.Get(extractBuffer) //nolint:nilaway // the buffer pool is created in archive.go
 
 	uncompressed := strings.TrimSuffix(filepath.Base(f), ".zstd")
 	uncompressed = strings.TrimSuffix(uncompressed, ".zst")
diff --git a/pkg/compile/compile.go b/pkg/compile/compile.go
@@ -217,7 +217,5 @@ func Recursive(ctx context.Context, fss []fs.FS) (*yarax.Rules, error) {
 		return nil, fmt.Errorf("compile errors encountered: %v", errors)
 	}
 
-	yrs := yxc.Build()
-
-	return yrs, nil
+	return yxc.Build(), nil
 }
diff --git a/pkg/pool/pool.go b/pkg/pool/pool.go
@@ -46,11 +46,11 @@ func (bp *BufferPool) Get(size int64) []byte {
 	bufInterface := bp.pool.Get()
 
 	bufPtr, ok := bufInterface.(*[]byte)
-	if !ok || bufPtr == nil {
+	if !ok {
 		return make([]byte, size)
 	}
 
-	if cap(*bufPtr) < int(size) {
+	if bufPtr != nil && cap(*bufPtr) < int(size) {
 		bp.pool.Put(bufPtr)
 		return make([]byte, size)
 	}
@@ -95,8 +95,13 @@ func NewScannerPool(yrs *yarax.Rules, count int) *ScannerPool {
 }
 
 // Get retrieves a scanner from the scanner pool, blocking if none are available.
-func (sp *ScannerPool) Get() *yarax.Scanner {
-	return <-sp.scanners
+func (sp *ScannerPool) Get(yrs *yarax.Rules) *yarax.Scanner {
+	if sp != nil {
+		return <-sp.scanners
+	}
+	// Guard against a nil scanner pool and
+	// create a new scanner with the cached rules as a fallback
+	return yarax.NewScanner(yrs)
 }
 
 // Put returns a scanner to the scanner pool.
diff --git a/pkg/programkind/programkind.go b/pkg/programkind/programkind.go
@@ -259,7 +259,7 @@ func File(path string) (*FileType, error) {
 
 	initializeHeaderPool()
 
-	buf := headerPool.Get(int64(headerSize))
+	buf := headerPool.Get(int64(headerSize)) //nolint:nilaway // the buffer pool is created above
 	defer headerPool.Put(buf)
 
 	f, err := os.Open(path)
diff --git a/pkg/render/json.go b/pkg/render/json.go
@@ -33,6 +33,11 @@ func (r JSON) Full(ctx context.Context, c *malcontent.Config, rep *malcontent.Re
 		return ctx.Err()
 	}
 
+	// guard against nil reports
+	if rep == nil {
+		return nil
+	}
+
 	jr := Report{
 		Diff:   rep.Diff,
 		Files:  make(map[string]*malcontent.FileReport),
@@ -61,7 +66,9 @@ func (r JSON) Full(ctx context.Context, c *malcontent.Config, rep *malcontent.Re
 	})
 
 	if c != nil && c.Stats && jr.Diff == nil {
-		jr.Stats = serializedStats(c, rep)
+		if s := serializedStats(c, rep); s != nil {
+			jr.Stats = s
+		}
 	}
 
 	j, err := json.MarshalIndent(jr, "", "    ")
diff --git a/pkg/render/markdown.go b/pkg/render/markdown.go
@@ -68,7 +68,7 @@ func (r Markdown) Full(ctx context.Context, _ *malcontent.Config, rep *malconten
 		return ctx.Err()
 	}
 
-	if rep.Diff == nil {
+	if rep == nil || rep.Diff == nil {
 		return nil
 	}
 
diff --git a/pkg/render/render.go b/pkg/render/render.go
@@ -70,6 +70,11 @@ func riskEmoji(score int) string {
 }
 
 func serializedStats(c *malcontent.Config, r *malcontent.Report) *Stats {
+	// guard against nil reports
+	if r == nil {
+		return nil
+	}
+
 	pkgStats, _, totalBehaviors := PkgStatistics(c, &r.Files)
 	riskStats, totalRisks, processedFiles, skippedFiles := RiskStatistics(c, &r.Files)
 
diff --git a/pkg/render/simple.go b/pkg/render/simple.go
@@ -57,7 +57,8 @@ func (r Simple) Full(ctx context.Context, _ *malcontent.Config, rep *malcontent.
 		return ctx.Err()
 	}
 
-	if rep.Diff == nil {
+	// guard against nil reports
+	if rep == nil || rep.Diff == nil {
 		return nil
 	}
 
diff --git a/pkg/render/stats.go b/pkg/render/stats.go
@@ -117,6 +117,11 @@ func PkgStatistics(_ *malcontent.Config, files *sync.Map) ([]malcontent.StrMetri
 }
 
 func Statistics(c *malcontent.Config, r *malcontent.Report) error {
+	// guard against nil reports
+	if r == nil {
+		return fmt.Errorf("unexpected nil report")
+	}
+
 	riskStats, totalRisks, processedFiles, skippedFiles := RiskStatistics(c, &r.Files)
 	pkgStats, width, totalBehaviors := PkgStatistics(c, &r.Files)
 
diff --git a/pkg/render/strings.go b/pkg/render/strings.go
@@ -118,8 +118,9 @@ func (r StringMatches) Full(ctx context.Context, _ *malcontent.Config, rep *malc
 		return ctx.Err()
 	}
 
+	// guard against nil reports
 	// Non-diff files are handled on the fly by File()
-	if rep.Diff == nil {
+	if rep == nil || rep.Diff == nil {
 		return nil
 	}
 
diff --git a/pkg/render/terminal.go b/pkg/render/terminal.go
@@ -101,8 +101,9 @@ func (r Terminal) Full(ctx context.Context, _ *malcontent.Config, rep *malconten
 		return ctx.Err()
 	}
 
+	// guard against nil reports
 	// Non-diff files are handled on the fly by File()
-	if rep.Diff == nil {
+	if rep == nil || rep.Diff == nil {
 		return nil
 	}
 
@@ -187,8 +188,14 @@ func nsLongName(s string) string {
 // split rule into namespace + resource/technique.
 func splitRuleID(s string) (string, string) {
 	parts := strings.Split(s, "/")
-	rest := strings.Join(parts[1:], "/")
-	return parts[0], rest
+	var id, rest string
+	if len(parts) > 0 {
+		id = parts[0]
+		if len(parts) > 1 {
+			rest = strings.Join(parts[1:], "/")
+		}
+	}
+	return id, rest
 }
 
 // suggestedWidth calculates a maximum terminal width to render against.
diff --git a/pkg/render/terminal_brief.go b/pkg/render/terminal_brief.go
@@ -78,8 +78,9 @@ func (r TerminalBrief) Full(ctx context.Context, _ *malcontent.Config, rep *malc
 		return ctx.Err()
 	}
 
+	// guard against nil reports
 	// Non-diff files are handled on the fly by File()
-	if rep.Diff == nil {
+	if rep == nil || rep.Diff == nil {
 		return nil
 	}
 
diff --git a/pkg/render/yaml.go b/pkg/render/yaml.go
@@ -33,6 +33,11 @@ func (r YAML) Full(ctx context.Context, c *malcontent.Config, rep *malcontent.Re
 		return ctx.Err()
 	}
 
+	// guard against nil reports
+	if rep == nil {
+		return nil
+	}
+
 	// Make the sync.Map YAML-friendly
 	yr := Report{
 		Diff:   rep.Diff,
@@ -60,7 +65,9 @@ func (r YAML) Full(ctx context.Context, c *malcontent.Config, rep *malcontent.Re
 	})
 
 	if c != nil && c.Stats && yr.Diff == nil {
-		yr.Stats = serializedStats(c, rep)
+		if s := serializedStats(c, rep); s != nil {
+			yr.Stats = s
+		}
 	}
 
 	yaml, err := yaml.Marshal(yr)
diff --git a/pkg/report/report.go b/pkg/report/report.go
diff --git a/pkg/report/strings.go b/pkg/report/strings.go

Original file line number	Diff line number	Diff line change
`@@ -31,7 +31,7 @@ func ExtractBz2(ctx context.Context, d, f string) error {`
`31`	`31`	`return nil`
`32`	`32`	`}`
`33`	`33`
`34`		`- buf := archivePool.Get(extractBuffer)`
	`34`	`+ buf := archivePool.Get(extractBuffer) //nolint:nilaway // the buffer pool is created in archive.go`
`35`	`35`
`36`	`36`	`tf, err := os.Open(f)`
`37`	`37`	`if err != nil {`
Original file line number	Diff line number	Diff line change
`@@ -53,7 +53,7 @@ func ExtractGzip(ctx context.Context, d string, f string) error {`
`53`	`53`	`return nil`
`54`	`54`	`}`
`55`	`55`
`56`		`- buf := archivePool.Get(extractBuffer)`
	`56`	`+ buf := archivePool.Get(extractBuffer) //nolint:nilaway // the buffer pool is created in archive.go`
`57`	`57`
`58`	`58`	`gf, err := os.Open(f)`
`59`	`59`	`if err != nil {`
Original file line number	Diff line number	Diff line change
`@@ -40,7 +40,7 @@ func ExtractRPM(ctx context.Context, d, f string) error {`
`40`	`40`	`return nil`
`41`	`41`	`}`
`42`	`42`
`43`		`- buf := archivePool.Get(extractBuffer)`
	`43`	`+ buf := archivePool.Get(extractBuffer) //nolint:nilaway // the buffer pool is created in archive.go`
`44`	`44`	`defer archivePool.Put(buf)`
`45`	`45`
`46`	`46`	`pkg, err := rpm.Read(rpmFile)`
Original file line number	Diff line number	Diff line change
`@@ -48,7 +48,7 @@ func ExtractTar(ctx context.Context, d string, f string) error {`
`48`	`48`	`return nil`
`49`	`49`	`}`
`50`	`50`
`51`		`- buf := tarPool.Get(extractBuffer)`
	`51`	`+ buf := tarPool.Get(extractBuffer) //nolint:nilaway // the buffer pool is created in archive.go`
`52`	`52`
`53`	`53`	`filename := filepath.Base(f)`
`54`	`54`	`tf, err := os.Open(f)`
Original file line number	Diff line number	Diff line change
`@@ -123,7 +123,7 @@ func extractFile(ctx context.Context, file zip.File, destDir string, logger cl`
`123`	`123`	`}`
`124`	`124`	`}`
`125`	`125`
`126`		`- buf := zipPool.Get(zipBuffer)`
	`126`	`+ buf := zipPool.Get(zipBuffer) //nolint:nilaway // the buffer pool is created in archive.go`
`127`	`127`
`128`	`128`	`clean := filepath.Clean(filepath.ToSlash(file.Name))`
`129`	`129`	`if strings.Contains(clean, "..") {`
Original file line number	Diff line number	Diff line change
`@@ -30,7 +30,7 @@ func ExtractZlib(ctx context.Context, d string, f string) error {`
`30`	`30`	`return nil`
`31`	`31`	`}`
`32`	`32`
`33`		`- buf := archivePool.Get(extractBuffer)`
	`33`	`+ buf := archivePool.Get(extractBuffer) //nolint:nilaway // the buffer pool is created in archive.go`
`34`	`34`	`defer archivePool.Put(buf)`
`35`	`35`
`36`	`36`	`zf, err := os.Open(f)`
Original file line number	Diff line number	Diff line change
`@@ -30,7 +30,7 @@ func ExtractZstd(ctx context.Context, d string, f string) error {`
`30`	`30`	`return nil`
`31`	`31`	`}`
`32`	`32`
`33`		`- buf := archivePool.Get(extractBuffer)`
	`33`	`+ buf := archivePool.Get(extractBuffer) //nolint:nilaway // the buffer pool is created in archive.go`
`34`	`34`
`35`	`35`	`uncompressed := strings.TrimSuffix(filepath.Base(f), ".zstd")`
`36`	`36`	`uncompressed = strings.TrimSuffix(uncompressed, ".zst")`