Skip to content
PR Quorum
Sign inStart free
← Review gallery
go-gitea/gitea #38518openreviewed 6h ago

fix(actions): correctness and hardening fixes

by bircni+413 2117 filesreviewed in 54sView PR on GitHub
needs attentionThe panel surfaced issues that deserve attention before merge.1 finding · 1 high+

Reviewer panel

Correctness
deepseek/deepseek-v4-flash
errored
Security
deepseek/deepseek-v4-flash
errored
Architecture
deepseek/deepseek-v4-flash
1 found

Findings

01Hhighconf 80%

Potential nil pointer dereference when calling fillViewRunResponseSummary from a GET handler

routers/web/repo/actions/view.go:703

fillViewRunResponseSummary now calls web.GetForm(ctx).(*ViewRequest) to retrieve the client's JobSummariesVersion. This function is likely shared between the initial GET view and the POST polling handler. On the GET path no form body is parsed, so GetForm(ctx) may return nil, causing a nil pointer dereference when the type assertion (*ViewRequest) is performed. The resulting panic would make the run view inaccessible and return a 500 error to the user.

If the function is only called from the POST handler this is not a bug, but the diff does not alter the call sites and the original function was used in both View and ViewPost. The initial GET view would then panic on every request.

Suggested fix

if req, _ := web.GetForm(ctx).(*ViewRequest); req != nil && req.JobSummariesVersion != summariesVersion {

Want this on your own pull requests?
The same reviewer panel runs on every PR — one focused review, no noise.
Start freeLive demo