elastic / elastic/cloudbeat

Listen to ctx.Done() when sending to channels

Open
#1,108 1 comment 0 reactions 0 assignees View on GitHub
bug cloudbeat Team:Cloud Security technical debt
Dominant language
Go
Stars
58
Forks
55
Avg merge
9h 9m
Merged PRs (30d)
424

Description

## Background
A bug that we found in CNVM but can be relevant all across:
- https://github.com/elastic/cloudbeat/issues/1097

## Describe the bug
The pattern of sending an event on a channel without knowing who or when it is going to be consumed.
Examples outside of the vulnerability flavor in `pipeline.go`:
```go
go func() {
defer close(outputCh)
defer cancel()

for s := range inputChannel {
val, err := fn(ctx, s)
if err != nil {
log.Error(err)
continue
}
outputCh <- val
}
}()
```
Since `outputCh` is consumed outside of this section, sending to `outputCh` is not safe.
If for example the consumer will stop listening to this channel (because the context canceled) it will result in deadlock.
An alternative is to replace `outputCh <- val` with
```go
select {
case <- ctx.Done():
return
case outputCh <- val:
}
```

## Definition of done

- [ ] Map the sections in our source code who are in risk
- [ ] Suggest a fix where possible
- [ ] Add unit tests that **fail in the current state and pass after the fix**

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.