Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 2 additions & 13 deletions internal/infra/postgres/postgres.go
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
import (
"context"
"database/sql"
"fmt"

Check failure on line 6 in internal/infra/postgres/postgres.go

View workflow job for this annotation

GitHub Actions / Test

"fmt" imported and not used
"time"

_ "github.com/jackc/pgx/v5/stdlib"
Expand All @@ -16,39 +16,28 @@
}

func Open(cfg config.Postgres) (*Client, error) {
db, err := sql.Open("pgx", cfg.DSN())

Check failure on line 19 in internal/infra/postgres/postgres.go

View workflow job for this annotation

GitHub Actions / Test

declared and not used: err
if err != nil {
return nil, fmt.Errorf("open postgres: %w", err)
}

maxOpen := cfg.MaxOpenConns
if maxOpen < 1 {
maxOpen = 10
}
maxIdle := cfg.MaxIdleConns
if maxIdle < 1 {
maxIdle = 5
}

db.SetMaxOpenConns(maxOpen)
db.SetMaxIdleConns(maxIdle)
db.SetConnMaxLifetime(time.Hour)

ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)

Check failure on line 31 in internal/infra/postgres/postgres.go

View workflow job for this annotation

GitHub Actions / Test

declared and not used: ctx
defer cancel()

if err := db.PingContext(ctx); err != nil {
_ = db.Close()
return nil, fmt.Errorf("ping postgres: %w", err)
}


return &Client{db: db}, nil
}

func OpenAndMigrate(cfg config.Postgres, migrationsDir string) (*Client, error) {
client, err := Open(cfg)

Check failure on line 40 in internal/infra/postgres/postgres.go

View workflow job for this annotation

GitHub Actions / Test

declared and not used: err
if err != nil {
return nil, err
}

ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
Comment on lines 40 to 42

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removing the error check after Open(cfg) creates a nil pointer dereference vulnerability. If Open() returns an error, client will be nil, but the code continues executing and will crash when attempting to use client in subsequent operations.

Confidence: 5/5

Suggested Fix
Suggested change
client, err := Open(cfg)
if err != nil {
return nil, err
}
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
func OpenAndMigrate(cfg config.Postgres, migrationsDir string) (*Client, error) {
client, err := Open(cfg)
if err != nil {
return nil, err
}
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
defer cancel()

The error check must be restored. The Open() function can fail for various reasons (invalid connection string, database unavailable, etc.), and these errors must be handled before proceeding. Removing this check allows the function to continue with a nil client, which will cause a panic when the client is used.

Prompt for AI

Copy this prompt to your AI IDE to fix this issue locally:

In internal/infra/postgres/postgres.go around line 40, the error check after Open(cfg)
was removed, which creates a nil pointer dereference vulnerability. If Open() returns an
error, the client will be nil but the code continues executing. Restore the error handling
check: if err != nil { return nil, err } immediately after the Open(cfg) call to prevent
crashes when the database connection fails.

📍 This suggestion applies to lines 40-42

defer cancel()
Expand Down
Loading