meshery / meshery/meshkit

UpdatePackageData panics on a malformed helm repository index (unguarded [0] index / type assertion)

Open
#1,061 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
223
Forks
225
Avg merge
7d 1h
Merged PRs (30d)
1

Description

### Current Behavior

`AhPackage.UpdatePackageData` (`generators/artifacthub/package.go`) extracts the chart URL from a remote helm repository `index.yaml` with unguarded type assertions and index accesses:

```go
urls, ok := pkgEntry.([]interface{})[0].(map[interface{}]interface{})["urls"]
if urls == nil || !ok { ... }
chartUrl, ok := urls.([]interface{})[0].(string)
if !ok || chartUrl == "" { ... }
```

The comma-ok only covers the final map/type lookups. The `.([]interface{})` assertions and the `[0]` indexes are **unchecked**, so a malformed (but valid-YAML) index panics the model generator:

- **`pkgEntry.([]interface{})[0]`** — panics with `index out of range [0] with length 0` when a chart name maps to an empty version list (`mychart: []`), or `interface conversion` when the entry is not a list.
- **`urls.([]interface{})[0]`** — panics the same way when `urls` is empty or not a list.

This data comes from a remote `index.yaml` (`utils.ReadRemoteFile`), so it is externally controlled: any ArtifactHub package pointing at a repository whose index has an empty version list, an empty `urls`, or an unexpected shape crashes generation.

### Expected Behavior

Malformed / unexpected index data returns an error (the existing `ErrGetChartUrl`) instead of panicking.

### Steps to Reproduce

Point an `AhPackage` at a helm repo whose `index.yaml` contains, for the target chart, an empty version list (`entries: { mychart: [] }`) and call `UpdatePackageData()` → panic (`index out of range [0]`).

### Environment

- meshkit: current `master`

Contributor guide

Open the contributing guide

Research direction

Start in generators/artifacthub/package.go at AhPackage.UpdatePackageData and inspect how the remote index.yaml is read and how chart URLs are extracted. Reproduce with an empty version list and malformed or empty urls data, then verify each unexpected shape returns the existing ErrGetChartUrl instead of panicking.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, helm
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
74/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.