panic: runtime error: index out of range [-1]

[williamdes]

What happened?

panic: runtime error: index out of range [-1]

goroutine 1 [running]:
github.com/crowdsecurity/crowdsec/pkg/hubtest.LoadParserDump({0xc00013e600, 0x2d})
	github.com/crowdsecurity/crowdsec/pkg/hubtest/parser_assert.go:341 +0x8c5
main.runExplain(0xc000899c00?, {0xc0006c7840?, 0x4?, 0x1e76976?})
	github.com/crowdsecurity/crowdsec/cmd/crowdsec-cli/explain.go:178 +0xbde
github.com/spf13/cobra.(*Command).execute(0xc0008a8600, {0xc0006c7800, 0x4, 0x4})
	github.com/spf13/[email protected]/command.go:940 +0x87c
github.com/spf13/cobra.(*Command).ExecuteC(0xc000822600)
	github.com/spf13/[email protected]/command.go:1068 +0x3a5
github.com/spf13/cobra.(*Command).Execute(...)
	github.com/spf13/[email protected]/command.go:992
main.main()
	github.com/crowdsecurity/crowdsec/cmd/crowdsec-cli/main.go:267 +0xe5f

What did you expect to happen?

No crash

How can we reproduce it (as minimally and precisely as possible)?

echo ''  | cscli explain --type syslog -f -
panic: runtime error: index out of range [-1]

goroutine 1 [running]:
github.com/crowdsecurity/crowdsec/pkg/hubtest.LoadParserDump({0xc00013e600, 0x2d})
	github.com/crowdsecurity/crowdsec/pkg/hubtest/parser_assert.go:341 +0x8c5
main.runExplain(0xc000899c00?, {0xc0006c7840?, 0x4?, 0x1e76976?})
	github.com/crowdsecurity/crowdsec/cmd/crowdsec-cli/explain.go:178 +0xbde
github.com/spf13/cobra.(*Command).execute(0xc0008a8600, {0xc0006c7800, 0x4, 0x4})
	github.com/spf13/[email protected]/command.go:940 +0x87c
github.com/spf13/cobra.(*Command).ExecuteC(0xc000822600)
	github.com/spf13/[email protected]/command.go:1068 +0x3a5
github.com/spf13/cobra.(*Command).Execute(...)
	github.com/spf13/[email protected]/command.go:992
main.main()
	github.com/crowdsecurity/crowdsec/cmd/crowdsec-cli/main.go:267 +0xe5f

Anything else we need to know?

No response

Crowdsec version

$ cscli version
2023/11/21 20:56:03 version: v1.5.5-debian-pragmatic-amd64-d2d788c5dc0a9e387635276623c6781774a9dfd4
2023/11/21 20:56:03 Codename: alphaga
2023/11/21 20:56:03 BuildDate: 2023-10-24_08:03:17
2023/11/21 20:56:03 GoVersion: 1.21.3
2023/11/21 20:56:03 Platform: linux
2023/11/21 20:56:03 libre2: C++
2023/11/21 20:56:03 Constraint_parser: >= 1.0, <= 2.0
2023/11/21 20:56:03 Constraint_scenario: >= 1.0, < 3.0
2023/11/21 20:56:03 Constraint_api: v1
2023/11/21 20:56:03 Constraint_acquis: >= 1.0, < 2.0

$ apt policy crowdsec
crowdsec:
  Installed: 1.5.5
  Candidate: 1.5.5
  Version table:
 *** 1.5.5 500
        500 https://packagecloud.io/crowdsec/crowdsec/debian bookworm/main amd64 Packages
        100 /var/lib/dpkg/status

OS version

No response

Enabled collections and parsers

No response

Acquisition config

No response

Config show

No response

Prometheus metrics

No response

Related custom configs versions (if applicable) : notification plugins, custom scenarios, parsers etc.

No response

[github-actions]

@williamdes: Thanks for opening an issue, it is currently awaiting triage.

In the meantime, you can:

1. Check Crowdsec Documentation to see if your issue can be self resolved.
2. You can also join our Discord.
3. Check Releases to make sure your agent is on the latest version.

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[LaurenceJJones]

Thank you for concise replication instruction. Can confirm this happens on main branch, will spend sometime next week ironing it out.

[mmetc]

After the hub refactoring that was merged yesterday, master gives:

FATA[2023-11-25 23:32:23] unable to load parser dump result: no parser found. Please install the appropriate parser and retry

There is even a regression test. Is the message appropriate?

[williamdes]

After the hub refactoring that was merged yesterday, master gives:

FATA[2023-11-25 23:32:23] unable to load parser dump result: no parser found. Please install the appropriate parser and retry

There is even a regression test. Is the message appropriate?

For me it is not, it should say there is no input data.
If my echo '' was a script output, you would waste precious debug hours not knowing it outputs void.
What happened, I did run: grep -F "foobar" /var/log/file.log | cscli explain --type syslog -f - and since there was no input: it crashed

I think the message should be explicit about no data in the input or even in a file (does this make a crash too ?)

[LaurenceJJones]

Guess we could add a check to linecount

crowdsec/cmd/crowdsec-cli/explain.go

Lines 144 to 150 in 7c5cbef

	lineCount, err := GetLineCountForFile(absolutePath)
	if err != nil {
	return err
	}
	if lineCount > 100 {
	log.Warnf("The log file contains %d lines. This may take a lot of resources.", lineCount)
	}

If 0 return error as there is no content. This will work for logfile, log line and stdin.

[LaurenceJJones]

Merged fix, will be in 1.5.6