Handle nil values from Trusty API (#3638)

mindersec · Jun 18, 2024 · 25d94a8 · 25d94a8
1 parent d243a44
commit 25d94a8
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 1 deletion.
diff --git a/internal/engine/eval/trusty/trusty.go b/internal/engine/eval/trusty/trusty.go
@@ -338,7 +338,7 @@ func readPackageDescription(resp *trustytypes.Reply) map[string]any {
 
 	// Ensure don't panic checking all fields are there
 	for _, fld := range []string{"activity", "provenance"} {
-		if _, ok := descr[fld]; !ok {
+		if _, ok := descr[fld]; !ok || descr[fld] == nil {
 			descr[fld] = float64(0)
 		}
 	}

diff --git a/internal/engine/eval/trusty/trusty_test.go b/internal/engine/eval/trusty/trusty_test.go
@@ -348,6 +348,24 @@ func TestClassifyDependency(t *testing.T) {
 			},
 			mustFilter: true,
 		},
+		{
+			name: "nil-activity",
+			score: &trustytypes.Reply{
+				PackageName: "test",
+				PackageType: "npm",
+				Summary: trustytypes.ScoreSummary{
+					Score: mkfloat(8.0),
+					Description: map[string]any{
+						"provenance": nil,
+					},
+				},
+			},
+			config: defaultConfig(),
+			expected: &dependencyAlternatives{
+				Reasons: []RuleViolationReason{},
+			},
+			mustFilter: false,
+		},
 	} {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {