Fix program fetching failing on VDP programs - #19
Open
rebirth808 wants to merge 1 commit into
Open
Conversation
Programs of type `vdp-in-app` returned by the YesWeHack API do not carry
the `qualifying_vulnerability`, `non_qualifying_vulnerability`, `public`
and `vpn_active` keys. Those constructor parameters are non-nullable and
have no default value, so jackson-module-kotlin throws:
Instantiation of [simple type, class yesweburp.api.Program] value
failed for JSON property qualifying_vulnerability due to missing
(therefore NULL) value
Since fetchPrograms() loads every program detail into a single list, a
single VDP in the account is enough to make the whole "Fetch programs"
action fail, leaving the extension unusable.
Give the fields that the API may omit a safe default so that partial
payloads deserialize instead of aborting the fetch. Pagination, Scope and
BusinessUnit get the same treatment to keep future API changes from
breaking the whole listing.
Fixes yeswehack#13
Fixes yeswehack#15
Fixes yeswehack#17
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ExFZMZrq2YL6kBoJJtRhhN
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Fetch programsfails with:The YesWeHack API returns programs of type
vdp-in-appalongsidebug-bountyones, and VDP payloads simply do not contain thequalifying_vulnerability,non_qualifying_vulnerability,publicandvpn_activekeys. Those are declared as non-nullable constructor parameters without defaults, sojackson-module-kotlinrefuses to instantiateProgram.Because
fetchPrograms()collects every program detail into one list, a single VDP is enough to break the entire fetch — the extension shows the error and lists nothing at all.Reproduction
At the time of writing,
digital-flanders-vulnerability-disclosure-programis a public VDP that triggers it. Deserializing the detail payloads of all 64 public programs with the released v2.0.2 classes:With this patch applied:
Bug bounty programs are unaffected: scopes, qualifying/non-qualifying lists, reward grids and currency still deserialize identically.
Fix
Give a safe default to the fields the API may omit, so partial payloads degrade gracefully instead of aborting the whole listing.
Pagination,ScopeandBusinessUnitget the same treatment, so a future field rename does not take the entire program list down again (the mapper already setsFAIL_ON_UNKNOWN_PROPERTIEStofalse, this is the symmetric protection for missing ones).One file, 11 lines, no behaviour change for existing programs.
Notes
qualifying_vulnerabilitykey #13, Instantiation of value failed JSON property #15 and Bug: JSON property "qualifying" fails to instantiate Program class (v2.0.2) #17, which all report this same crash.bug-bountyonly. That works, but it also hides VDP programs from the extension — this patch keeps them visible instead.AuthMethod.ANONYMOUS -> {}branch in thewhenofAPIPanel.kt, since a non-exhaustivewhenon an enum is now an error. Happy to add it here if you want it in the same PR.