Summary
The error returned by api.GetRobot() is silently discarded with _
in three command files. When GetRobot fails, the result is nil and
the immediate dereference of res.Payload causes a nil pointer panic,
crashing the CLI. This only triggers in the -o json or -o yaml
output path, making it easy to miss in normal testing.
Environment
- Commit SHA: e23964a
- Repository: goharbor/harbor-cli
- Trigger: using
-o json or -o yaml flag with robot create/update commands
Affected Files (3 locations, identical pattern)
File 1
cmd/harbor/root/project/robot/create.go — line 205
name := response.Payload.Name
res, _ := api.GetRobot(response.Payload.ID) // error discarded
utils.SavePayloadJSON(name, res.Payload) // PANIC if res is nil
return nil
File 2
cmd/harbor/root/robot/create.go — line 334
res, _ := api.GetRobot(response.Payload.ID)
utils.SavePayloadJSON(response.Payload.Name, res.Payload)
return nil
File 3
cmd/harbor/root/robot/update.go — line 590
res, _ := api.GetRobot(opts.ID)
utils.SavePayloadJSON(opts.Name, res.Payload)
Steps to Reproduce
- Login to a Harbor instance
- Create a robot account with JSON output:
harbor project robot create -o json
- If
GetRobot call fails (network error, auth expiration between calls),
the CLI panics with a nil pointer dereference instead of returning a
clean error.
Expected Behavior
GetRobot errors should be checked and returned with a user-friendly
error message, matching the pattern already used for the same
api.GetRobot() call in other commands.
Actual Behavior
CLI panics with nil pointer dereference, crashes.
Note
The same api.GetRobot() function is called with proper error handling
in the view and update commands (e.g., project/robot/view.go:93-95,
project/robot/update.go:110). The create and update output-format
paths are the only places where the error is discarded.
Summary
The error returned by
api.GetRobot()is silently discarded with_in three command files. When
GetRobotfails, the result is nil andthe immediate dereference of
res.Payloadcauses a nil pointer panic,crashing the CLI. This only triggers in the
-o jsonor-o yamloutput path, making it easy to miss in normal testing.
Environment
-o jsonor-o yamlflag with robot create/update commandsAffected Files (3 locations, identical pattern)
File 1
cmd/harbor/root/project/robot/create.go— line 205File 2
cmd/harbor/root/robot/create.go— line 334File 3
cmd/harbor/root/robot/update.go— line 590Steps to Reproduce
harbor project robot create -o jsonGetRobotcall fails (network error, auth expiration between calls),the CLI panics with a nil pointer dereference instead of returning a
clean error.
Expected Behavior
GetRoboterrors should be checked and returned with a user-friendlyerror message, matching the pattern already used for the same
api.GetRobot()call in other commands.Actual Behavior
CLI panics with nil pointer dereference, crashes.
Note
The same
api.GetRobot()function is called with proper error handlingin the view and update commands (e.g.,
project/robot/view.go:93-95,project/robot/update.go:110). The create and update output-formatpaths are the only places where the error is discarded.