Skip to content

fix: replace panics on malformed/unexpected input with graceful errors - #967

Closed
dst-port wants to merge 3 commits into
vinegarhq:masterfrom
dst-port:fix/panic-on-malformed-input
Closed

dst-port wants to merge 3 commits into
vinegarhq:masterfrom
dst-port:fix/panic-on-malformed-input

Conversation

@dst-port

@dst-port dst-port commented Sep 7, 2026

Copy link
Copy Markdown

Three spots parse external/config input and panic() on an unexpected shape instead of degrading. Found while reading through the codebase; each is small and independently verifiable.

1. bootstrapper.go — log line with exactly two commas crashes the GUI

handleRobloxLog does strings.SplitN(line, ",", 4). A line with exactly two commas returns 3 elements, which clears the len(entry) < 3 guard; entry[3:] is then empty, so len(entry) != 1 is true and it hits panic(entry). Requiring the full 4-element split fixes it and matches the documented format (time,runtime,code,code2[,level] ...).

2. bootstrapper_roblosec.go — nil-deref / type-assert panics on the Wine credential registry

getSecurity read three registry values via GetValue(...).Data.([]byte) with no nil check and no comma-ok assertion. A missing or malformed HKCU\Software\Wine\Credential Manager key panics instead of returning the error setupExecute already handles ("Retrieving authenticated user failed"). Factored the three call sites into a small registryBytes helper that returns an error instead.

3. manager_bind.go — Settings window crashes on an fflag with an unexpected TOML type

FFlags is map[string]any; TOML decodes a fractional number to float64 and arrays/tables to other types, none of which the addKeyRow switch handles, so it panics. A config.toml with e.g. DFIntFoo = 1.5 under [studio.fflags] crashes the Settings window the moment it's opened, even though the config is otherwise valid TOML. Falls back to an editable text row instead of panicking.

Verified go build ./..., go vet ./..., gofmt, and go test ./... all pass with these changes; no new vet findings introduced (the existing unkeyed-field/unsafe.Pointer warnings elsewhere are pre-existing and untouched).

effects3d and others added 3 commits September 5, 2026 18:12
Fixes WebView2 flickering when resizing the toolbox window.

Signed-off-by: effects3d <effects3dee@gmail.com>
Signed-off-by: effects3d <effects3dee@gmail.com>
- bootstrapper.go: a Roblox log line with exactly two commas hit
  panic(entry) in handleRobloxLog due to an off-by-one in the SplitN
  guard (3 elements passed the < 3 check, then entry[3:] was empty).
  Require the full 4-element split instead.
- bootstrapper_roblosec.go: getSecurity read Wine credential-registry
  values via GetValue(...).Data.([]byte) with no nil check or
  comma-ok assertion, panicking on a missing or malformed credential
  store instead of returning the error the caller already handles.
  Factored into a small registryBytes helper used at all three
  call sites.
- manager_bind.go: addKeyRow panicked on any FFlags value whose TOML
  type isn't bool/string/int64 (e.g. a float or an array), crashing
  the Settings window on open for an otherwise valid config.toml.
  Fall back to an editable text row instead.

Verified: go build ./..., go vet, gofmt, and go test ./... all pass.
@sewnie

sewnie commented Sep 7, 2026

Copy link
Copy Markdown
Member

LLM contributions are not accepted.

@sewnie sewnie closed this Sep 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants