Skip to content

Fix TypeError in oracle/networking/lbNoInstances.js - #2201

Open
ByteMeShiv wants to merge 1 commit into
aquasecurity:masterfrom
ByteMeShiv:fix/lbNoInstances-typeerror
Open

Fix TypeError in oracle/networking/lbNoInstances.js#2201
ByteMeShiv wants to merge 1 commit into
aquasecurity:masterfrom
ByteMeShiv:fix/lbNoInstances-typeerror

Conversation

@ByteMeShiv

Copy link
Copy Markdown

Bug

The lbNoInstances plugin throws an uncaught TypeError when scanning a load balancer that has backend instances actually attached, causing the entire Oracle scan to crash and exit non-zero (no report is generated when this happens).

node --max-old-space-size=8192 ./index.js --json=<file> --config ./cloudsploit_oci_config.js --console=none

/app/cloudsploit/plugins/oracle/networking/lbNoInstances.js:50
    helpers.addResult(results, 0, 'LB has ' + lb[lb.displayName].backends.length + ' backend instances', region, lb.id);
                                                                                    ^

TypeError: Cannot read properties of undefined (reading 'backends')
    at /app/cloudsploit/plugins/oracle/networking/lbNoInstances.js:50:90
    at /app/cloudsploit/node_modules/async/dist/async.js:3113:16
    at eachOfArrayLike (/app/cloudsploit/node_modules/async/dist/async.js:1072:9)
    at eachOf (/app/cloudsploit/node_modules/async/dist/async.js:1120:5)
    at Object.eachLimit (/app/cloudsploit/node_modules/async/dist/async.js:3175:5)
    at /app/cloudsploit/plugins/oracle/networking/lbNoInstances.js:42:23
    at /app/cloudsploit/node_modules/async/dist/async.js:3113:16
    at eachOfArrayLike (/app/cloudsploit/node_modules/async/dist/async.js:1072:9)
    at eachOf (/app/cloudsploit/node_modules/async/dist/async.js:1120:5)
    at Object.eachLimit (/app/cloudsploit/node_modules/async/dist/async.js:3175:5)

Root cause

The if guard correctly validates lbBackend (lb.backendSets['bs_' + lb.displayName]), but the success-branch message builder reads from a different, unrelated, and unvalidated property instead:

var lbBackend = lb.backendSets['bs_' + lb.displayName];
if (lbBackend && lbBackend.backends && lbBackend.backends.length) {
    helpers.addResult(results, 0, 'LB has ' + lb[lb.displayName].backends.length + ' backend instances', region, lb.id);
    //

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant