Skip to content

fix: handle nil AWS ALB entries - #758

Open
cyn8 wants to merge 1 commit into
projectdiscovery:devfrom
cyn8:fix/aws-alb-nil-entry
Open

fix: handle nil AWS ALB entries#758
cyn8 wants to merge 1 commit into
projectdiscovery:devfrom
cyn8:fix/aws-alb-nil-entry

Conversation

@cyn8

@cyn8 cyn8 commented Aug 12, 2026

Copy link
Copy Markdown

Summary

  • Defensively skip nil load balancer entries returned by ELBv2.
  • Extend the existing ALB nil-safety test to cover nil entries.

Follow-up to #743, which guards nil ALB fields but still dereferences the load-balancer pointer before checking it.

Test

  • go test ./pkg/providers/aws

Summary by CodeRabbit

  • Bug Fixes

    • Improved load balancer resource listing to safely ignore empty or incomplete load balancer entries.
    • Prevented potential errors when load balancer data is missing entirely.
  • Tests

    • Added coverage for load balancer entries that are unexpectedly empty.

@coderabbitai

coderabbitai Bot commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Walkthrough

The AWS ALB resource listing now skips nil load balancer entries before field access. The related test includes a nil entry and updates its name and assertion message.

Changes

ALB nil-entry handling

Layer / File(s) Summary
Skip nil load balancers
pkg/providers/aws/alb.go, pkg/providers/aws/alb_test.go
The ALB listing skips nil load balancers. The test covers nil and incomplete entries and verifies that they are skipped.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Poem

I’m a rabbit guarding the ALB gate,
Nil entries now must wait.
DNS and names still guide the way,
While safe tests keep bugs at bay.
Hop, skip, and ship today!

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the change to skip nil AWS ALB entries.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/providers/aws/alb_test.go`:
- Line 18: Update TestListELBV2Resources_NilLoadBalancer to exercise
listELBV2Resources through a mocked ELBv2 client instead of
processLoadBalancersForTest, so production nil handling is validated. Convert
the nil and incomplete load-balancer scenarios into table-driven inputs while
preserving coverage for nil entries and missing DNSName or LoadBalancerName.

In `@pkg/providers/aws/alb.go`:
- Line 77: Update the guard in the load balancer processing loop to reject both
nil and empty pointed-to DNSName values before constructing the resource.
Preserve the existing LoadBalancerName validation and ensure emitted resources
never contain an empty DNSName.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b00c2757-3c03-496c-a72e-62d4c5b4b56a

📥 Commits

Reviewing files that changed from the base of the PR and between e4dc46a and 5303f3b.

📒 Files selected for processing (2)
  • pkg/providers/aws/alb.go
  • pkg/providers/aws/alb_test.go

list := schema.NewResources()
for _, lb := range lbs {
if lb.DNSName == nil || lb.LoadBalancerName == nil {
if lb == nil || lb.DNSName == nil || lb.LoadBalancerName == nil {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

Exercise the production listing path.

processLoadBalancersForTest duplicates the filtering logic, and TestListELBV2Resources_NilLoadBalancer invokes that helper instead of listELBV2Resources. The test can pass even if the production method still dereferences a nil lb.

Use a mocked ELBv2 client to call the production method, or extract the shared filtering logic into a production helper. Express the nil and incomplete cases as table-driven inputs.

As per coding guidelines, provider tests should prefer mocked cloud provider clients and use table-driven tests for resource parsing.

Also applies to: 44-48

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/providers/aws/alb_test.go` at line 18, Update
TestListELBV2Resources_NilLoadBalancer to exercise listELBV2Resources through a
mocked ELBv2 client instead of processLoadBalancersForTest, so production nil
handling is validated. Convert the nil and incomplete load-balancer scenarios
into table-driven inputs while preserving coverage for nil entries and missing
DNSName or LoadBalancerName.

Source: Coding guidelines

Comment thread pkg/providers/aws/alb.go

for _, lb := range loadBalancers {
if lb.DNSName == nil || lb.LoadBalancerName == nil {
if lb == nil || lb.DNSName == nil || lb.LoadBalancerName == nil {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Reject empty DNS values, not only nil pointers.

The guard on Line 77 only checks whether DNSName is non-nil. aws.String("") is non-nil. If LoadBalancerName is populated, the loop emits a resource with an empty DNSName.

Check the pointed-to DNS value before constructing the resource.

Proposed fix
-		if lb == nil || lb.DNSName == nil || lb.LoadBalancerName == nil {
+		if lb == nil || lb.DNSName == nil || *lb.DNSName == "" || lb.LoadBalancerName == nil {

As per coding guidelines, each emitted resource must have at least one of IP or DNS populated; empty resources are invalid.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
if lb == nil || lb.DNSName == nil || lb.LoadBalancerName == nil {
if lb == nil || lb.DNSName == nil || *lb.DNSName == "" || lb.LoadBalancerName == nil {
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/providers/aws/alb.go` at line 77, Update the guard in the load balancer
processing loop to reject both nil and empty pointed-to DNSName values before
constructing the resource. Preserve the existing LoadBalancerName validation and
ensure emitted resources never contain an empty DNSName.

Source: Coding guidelines

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant