Fix scorecard descriptor test panic on non-object CR spec/status - #7114
Merged
acornett21 merged 1 commit intoJul 16, 2026
Merged
Conversation
The scorecard olm-spec-descriptors, olm-status-descriptors and
olm-crds-have-validation tests read a CR's spec and status from a
bundle's alm-examples annotation and type-assert them to
map[string]any while only guarding against nil. A bundle whose CR
has a spec or status that is a JSON scalar or array instead of an
object (for example "spec": "foo") makes the unguarded assertion
panic with "interface conversion: interface {} is string, not
map[string]interface {}", crashing the scorecard test binary on
malformed or untrusted bundle content.
Use comma-ok assertions at all four sites so a non-object spec or
status is handled the same as a missing one: the spec-descriptors
check reports a failed descriptor, and the status/validation checks
skip the field cleanly. Add regression tests that drive the real
check functions with a scalar spec and an array status and assert
they do not panic.
Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
acornett21
approved these changes
Jul 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of the change:
I work on supply-chain security and was looking at how the scorecard OLM tests handle bundle content. The
olm-spec-descriptors,olm-status-descriptors, andolm-crds-have-validationtests load a CR'sspecandstatusfrom a bundle'salm-examplesand type-assert them tomap[string]any, but they only guard against nil. If a CR has aspecorstatusthat isn't a JSON object (say"spec": "foo", or an array), the unguarded assertion panics:That crashes the scorecard test binary when it scans a malformed or untrusted bundle. This swaps the four assertions in
internal/scorecard/tests/olm.gofor comma-ok checks so a non-objectspec/statusis handled the same as a missing one: the spec-descriptors check reports it as a failed descriptor, and the status/validation checks just skip the field. No behavior change for well-formed bundles.The four sites:
checkOwnedCSVStatusDescriptor(statuslen check),checkOwnedCSVSpecDescriptors(specblock), and bothspecandstatusinisCRFromCRDApi.Added regression tests in
bundle_test.gothat drive the real check functions with a scalarspecand an arraystatusand assert they don't panic. Before this change those three specs fail with the panic above; after, all 24 specs pass.Motivation for the change:
Crash-hardening:
operator-sdk scorecardruns these tests against a bundle you may not control, so a scalar/array where an object is expected shouldn't take down the test binary.Checklist
If the pull request includes user-facing changes, extra documentation is required:
changelog/fragmentswebsite/content/en/docs