🐛 llx: stop array contains/difference builtins panicking on a null argument

llx/builtin_array.go

@@ -815,6 +815,14 @@ func arrayDifferenceV2(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64
 		return nil, rref, err
 	}
 
+	// A null argument (e.g. a missing map key resolving to a typed null
+	// array) propagates as null, mirroring the receiver-nil guard above.
+	// Without this the `arg.Value.([]any)` assertion below panics, which
+	// crashes the whole scan rather than failing the single check.
+	if arg.Value == nil {
+		return &RawData{Type: bind.Type, Error: arg.Error}, 0, nil
+	}
+
 	t := types.Type(arg.Type)
 	if t != bind.Type {
 		return nil, 0, errors.New("called `difference` with wrong type (got: " + t.Label() + ", expected:" + bind.Type.Label() + ")")
@@ -920,6 +928,14 @@ func arrayContainsAll(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64)
 		return nil, rref, err
 	}
 
+	// A null argument (e.g. a missing map key resolving to a typed null
+	// array) propagates as null, mirroring the receiver-nil guard above.
+	// Without this the `arg.Value.([]any)` assertion below panics, which
+	// crashes the whole scan rather than failing the single check.
+	if arg.Value == nil {
+		return &RawData{Type: bind.Type, Error: arg.Error}, 0, nil
+	}
+
 	t := types.Type(arg.Type)
 	if t != bind.Type {
 		return nil, 0, errors.New("called `arrayNone` with wrong type (got: " + t.Label() + ", expected:" + bind.Type.Label() + ")")
@@ -973,6 +989,14 @@ func arrayContainsNone(e *blockExecutor, bind *RawData, chunk *Chunk, ref uint64
 		return nil, rref, err
 	}
 
+	// A null argument (e.g. a missing map key resolving to a typed null
+	// array) propagates as null, mirroring the receiver-nil guard above.
+	// Without this the `arg.Value.([]any)` assertion below panics, which
+	// crashes the whole scan rather than failing the single check.
+	if arg.Value == nil {
+		return &RawData{Type: bind.Type, Error: arg.Error}, 0, nil
+	}
+
 	t := types.Type(arg.Type)
 	if t != bind.Type {
 		return nil, 0, errors.New("called `arrayNone` with wrong type (got: " + t.Label() + ", expected:" + bind.Type.Label() + ")")

providers/core/resources/mql_test.go

@@ -741,6 +741,31 @@ func TestArray(t *testing.T) {
 			Code:        "['x'].containsAll([asset.labels['nope']])",
 			Expectation: []any{nil},
 		},
+		// Regression: a null argument (e.g. a missing map key resolving to a
+		// typed null array, as happens on hosts with no /etc/pam.d) must
+		// propagate as null instead of panicking the whole scan with
+		// "interface conversion: interface {} is nil, not []interface {}".
+		{
+			Code:        "a = {a: [1,2]}; [1,2,3].containsAll(a['b'])",
+			Expectation: nil,
+		},
+		{
+			Code:        "a = {a: [1,2]}; [1,2,3].containsNone(a['b'])",
+			Expectation: nil,
+		},
+		{
+			Code:        "a = {a: [1,2]}; [1,2,3] - a['b']",
+			Expectation: nil,
+		},
+		// Regression: containsAll of an empty (typed, non-null) list is
+		// vacuously satisfied, so the compiled `== []` check is true. The
+		// mondoo-linux-security su-restriction check relies on this for
+		// `groups.containsAll(suRestrictedGroups)` when no group is configured
+		// and suRestrictedGroups is an empty []string.
+		{
+			Code:        `a = ["x", "y"]; ["wheel", "sudo"].containsAll(a.where(false))`,
+			ResultIndex: 1, Expectation: true,
+		},
 		{
 			Code:        "['a','b'] != /c/",
 			ResultIndex: 0, Expectation: true,