Skip to main content
← Back to list
01Issue
BugClosedSwamp CLIPublic
AssigneesNone

Relationships

#2002 Guard against null parseYaml returns in remaining YAML repositories

Opened by stack72 · 9/4/2026

Summary

YamlOutputRepository had a null-dereference crash when parseYaml returned null for empty/corrupt YAML files (fixed in #1997). The same unguarded pattern exists in several other YAML repositories:

  • YamlWorkflowRunRepository (6 call sites)
  • YamlDefinitionRepository (11 call sites)
  • [REDACTED-SECRET-1] (6 call sites)
  • YamlWorkflowRepository (5 call sites)
  • YamlEvaluatedWorkflowRepository (4 call sites)
  • FileSystemUnifiedDataRepository (2 call sites)
  • Others: SwampSourcesRepository, ExtensionWorkflowRepository, RepoMarkerRepository

What should happen

Each parseYaml call that scans directory entries should guard against null returns with if (!data) continue, matching the pattern applied in the YamlOutputRepository fix.

Priority

Low — these repositories are less likely to encounter empty files than the output repo (which has concurrent delete windows from TOCTOU races and GC). But the vulnerability is latent and could surface under disk pressure or interrupted writes.

02Bog Flow
✓OPEN○TRIAGED○IN PROGRESS◉CLOSED

Closed

9/4/2026, 4:41:10 PM

No activity in this phase yet.

03Sludge Pulse
Editable. Press Enter to edit.

stack72 commented 9/4/2026, 4:41:10 PM

Fixed in the same PR as #1997 — all YAML repositories now have null guards after parseYaml calls.

Sign in to post a ripple.