Skip to content

Fix possible KeyError #173

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conversation

roelandvanbatenburg
Copy link

I noticed this while upgrading to Elixir 1.18 from the new type system (see below). Sobelow.get_mod/1 can return nil, so we should account for that.

     warning: expected a map or struct when accessing .id in expression:

         Sobelow.get_mod(mod).id

     but got type:

         dynamic(
           Sobelow.CI or Sobelow.CI.OS or Sobelow.CI.System or Sobelow.Config or Sobelow.Config.CSP or
             Sobelow.Config.CSRF or Sobelow.Config.CSRFRoute or Sobelow.Config.CSWH or Sobelow.Config.HSTS or
             Sobelow.Config.HTTPS or Sobelow.Config.Headers or Sobelow.Config.Secrets or Sobelow.DOS or
             Sobelow.DOS.BinToAtom or Sobelow.DOS.ListToAtom or Sobelow.DOS.StringToAtom or Sobelow.Misc or
             Sobelow.Misc.BinToTerm or Sobelow.Misc.FilePath or Sobelow.RCE or Sobelow.RCE.CodeModule or
             Sobelow.RCE.EEx or Sobelow.SQL or Sobelow.SQL.Query or Sobelow.SQL.Stream or Sobelow.Traversal or
             Sobelow.Traversal.FileModule or Sobelow.Traversal.SendDownload or Sobelow.Traversal.SendFile or
             Sobelow.Vuln or Sobelow.Vuln.Coherence or Sobelow.Vuln.CookieRCE or Sobelow.Vuln.Ecto or
             Sobelow.Vuln.HeaderInject or Sobelow.Vuln.PlugNull or Sobelow.Vuln.Redirect or Sobelow.XSS or
             Sobelow.XSS.ContentType or Sobelow.XSS.HTML or Sobelow.XSS.Raw or Sobelow.XSS.SendResp or nil
         )

     where "mod" was given the type:

         # type: dynamic()
         # from: lib/sobelow/finding_log.ex:110:14
         [mod, _] = String.split(finding.type, ":", parts: 2)

     hint: "var.field" (without parentheses) means "var" is a map() while "var.fun()" (with parentheses) means "var" is an atom()

     typing violation found at:
     │
 113 │       ruleId: Sobelow.get_mod(mod).id,
     │                                    ~
     │
     └─ lib/sobelow/finding_log.ex:113:36: Sobelow.FindingLog.format_sarif/1

houllette pushed a commit to sobelow/sobelow that referenced this pull request May 8, 2025
@houllette
Copy link
Contributor

Hey @roelandvanbatenburg - sorry for the delay on this; for reasons explained in another issue (#180), I've created an official fork and I'm folding in this PR over there and giving you attribution. Feel free to close out this PR and follow progress over in the new repo here from now on!

@roelandvanbatenburg roelandvanbatenburg deleted the fix_possible_KeyError branch May 10, 2025 05:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants