A request with command arguments panics and terminates the whole server ai:claude-opus-5-5 #4

New issue

Closed

opened 2026-10-29 15:02:03 +01:00 by heiko · 0 comments

heiko commented

2026-10-29 15:02:03 +01:00

Owner

(co)authored by ai:claude-opus-5-5

Found while preparing the public software pages for www.schlittermann.de (static review, not a full audit).

cmd/nrpe/handler.go (around line 98):

args := strings.Split(request, "!")
if len(args) > 1 {
    panic("command parameters not implemented yet")
}

The handler runs in its own goroutine (go handleReq(conn, checker) in main.go). A search of the sources finds no recover() in the request path (only one in config.go). In Go an unrecovered panic in any goroutine terminates the process, so a single query containing ! should stop the monitoring agent. (Derived from reading the code; not tested against a running instance.)

Proposal: return an UNKNOWN/error response ("command arguments not supported") instead of panicking, and add defer recover() with logging in handleReq as a safety net. A regression test would be good.

(co)authored by ai:claude-opus-5-5 Found while preparing the public software pages for www.schlittermann.de (static review, not a full audit). `cmd/nrpe/handler.go` (around line 98): ```go args := strings.Split(request, "!") if len(args) > 1 { panic("command parameters not implemented yet") } ``` The handler runs in its own goroutine (`go handleReq(conn, checker)` in `main.go`). A search of the sources finds no `recover()` in the request path (only one in `config.go`). In Go an unrecovered panic in any goroutine terminates the process, so a single query containing `!` should stop the monitoring agent. (Derived from reading the code; not tested against a running instance.) **Proposal:** return an `UNKNOWN`/error response ("command arguments not supported") instead of panicking, and add `defer recover()` with logging in `handleReq` as a safety net. A regression test would be good.

heiko referenced this issue from a commit

2026-10-29 15:13:56 +01:00

handler: do not panic on malformed requests (closes #4)

heiko closed this issue

2026-10-29 15:13:56 +01:00