Nil reference panic in RuleResultSet.GenerateSpectralReport

[nd-jharn]

Issue

When applying rulesets on specifically circular referencing schemas, the circular-references-rule will in this specific case, not set a StartNode and EndNode. RuleResultSet.GenerateSpectralReport does not seem to check for this, and panics on nil reference.

It also crashes in the vacuum online demo (does that use the spectral report? might be different issue).

Reproducable schema

openapi: 3.0.1
components:
  schemas:
    Schema:
      type: object
      properties:
        anyOf:
          type: array
          items:
            $ref: '#/components/schemas/Schema'
    SchemaObject:
      type: object
      properties:
        anyOf:
          type: array
          items:
            $ref: '#/components/schemas/Schema'
        items:
          $ref: '#/components/schemas/SchemaObject'

Resulting RuleFunctionResult (Index = 1) in the ResultSet:

model.RuleFunctionResult {
    Message: "circular reference detected from #/components/schemas/SchemaObject",
    Range: github.com/daveshanley/vacuum/model/reports.Range {
        Start: (*"github.com/daveshanley/vacuum/model/reports.RangeItem")(0xc00026b8b0),
        End: (*"github.com/daveshanley/vacuum/model/reports.RangeItem")(0xc00026b8c0)
    },
    Path: "SchemaObject -> SchemaObject",
    RuleId: "circular-references",
    RuleSeverity: "",
    Origin: *github.com/pb33f/libopenapi/index.NodeOrigin nil,
    Rule: *github.com/daveshanley/vacuum/model.Rule {
        Id: "circular-references", Description: "Circular reference detected",
        Message: "Circular reference detected",
        Given: interface {}(string) *(*interface {})(0xc000000cf0),
        Formats: []string len: 0, cap: 0, nil, Resolved: false,
        Recommended: true, Type: "validation",
        Severity: "warn", Then: interface {}(github.com/daveshanley/vacuum/model.RuleAction) *(*interface {})(0xc000000d40),
        PrecompiledPattern: *regexp.Regexp nil,
        RuleCategory: *(*"github.com/daveshanley/vacuum/model.RuleCategory")(0xc00046a750),
        Name: "Circular References",
        HowToFix: "Circular references are created by schemas that reference back to themselves somewhere in the chain. The link could be very deep, or it could be super shallow. Sometimes it's hard to know what is looping without resolving the references. This model is looping, Remove the looping link in the chain. This can also appear with missing or references that cannot be located or resolved correctly."
    },
    StartNode: *gopkg.in/yaml%2ev3.Node nil,
    EndNode: *gopkg.in/yaml%2ev3.Node nil,
    Timestamp: *time.Time nil,
    ModelContext: interface {} nil
}

Stacktrace:

2024/11/28 17:32:37 [Recovery] 2024/11/28 - 17:32:37 panic recovered:
runtime error: invalid memory address or nil pointer dereference
/usr/lib/go/src/runtime/panic.go:262 (0xd6c29d)
	panicmem: panic(memoryError)
/usr/lib/go/src/runtime/signal_unix.go:917 (0xdac0a4)
	sigpanic: panicmem()
/*****/go/pkg/mod/github.com/daveshanley/[email protected]/model/results.go:102 (0x1d29ffc)
	(*RuleResultSet).GenerateSpectralReport: Line: result.StartNode.Line,
/*****/project/src/rules/validator.go:101 (0x220357a)
	Validate: spectralReport := resultSet.GenerateSpectralReport(filename)

When stepping over it basically panics on https://github.com/daveshanley/vacuum/blob/main/model/results.go#L102
It doesnt seem to make a difference to upgrade to 0.14.3.

Thank you for providing the online demo, it helped me keep my sanity.

Background

I co-maintain some Microservices that return or accept OpenAPI 3.0 documents, and as a result basically describe the entire OpenAPI3 document schema. In the Schema -> SchemaObject -> ... reference structure there is a certain chain that seems to confuse either libopenapi or vacuum, depending how you see it. I spent most of today crafting a minimal reproduction, but can provide the entire doc if required. Its basically just the OpenAPI v3 schema, specified in OpenAPIv3.

[daveshanley]

Thank you for finding panics, they are my number one enemy. They do crash the online services (which restart almost instantly and resume state) however, it's still like letting a bomb off on the platform.

I'll look into this asap.