date_time, url_encode, html_escape, to_unix_time, contains_all and contains_any panic when called without arguments

Closed Beginner friendly
  • Is something wrong?
#372 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

A pull request for this has already been merged.

  • #373 by @antcybersec — merged

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
go
Domain
backend

Research direction

Start with the date_time helper, where the argument-count check runs after arguments[0] is read and uses && where it needs ||. The other five helpers (url_encode, html_escape, to_unix_time, contains_all, contains_any) lack any count check and should return ErrInvalidDslFunction for zero arguments. Done means all six return that error with no arguments, date_time rejects extra arguments, and TestHelpersDoNotPanicOnNumericArgument also covers zero-argument calls.

Written by the indexing model from the issue text.

Description

Description

Six variadic helpers read args[0] before checking how many arguments they got. govaluate doesn't check argument counts when an expression is compiled, so a template with this mistake passes validation and then panics at run time. On main @ d61d88b:

date_time()      => panic: runtime error: index out of range [0] with length 0
url_encode()     => panic: runtime error: index out of range [0] with length 0
html_escape()    => panic: runtime error: index out of range [0] with length 0
to_unix_time()   => panic: runtime error: index out of range [0] with length 0
contains_all()   => panic: runtime error: index out of range [0] with length 0
contains_any()   => panic: runtime error: index out of range [0] with length 0

The aliases without underscores behave the same.

date_time also accepts too many arguments: date_time("%Y", 0, 1) ignores the timestamp and returns the current year (2026), where it should return an error.

Root cause
  • date_time checks if argumentsSize < 1 && argumentsSize > 2, which can never be true; it should use ||. The check also runs after toString(arguments[0]), so it would come too late anyway.
  • url_encode, html_escape, to_unix_time, contains_all and contains_any have no argument-count check.

This is the same class of bug as #357 and #367. TestHelpersDoNotPanicOnNumericArgument calls each helper with 1 to 4 arguments but never with 0, which is why these were missed.

Fix
  • In date_time, change && to || and move the check above the first arguments[0] read.
  • In the other five, return ErrInvalidDslFunction when len(args) < 1.
  • Extend the no-panic test to call each helper with zero arguments as well.

I can send a PR for this.

Dominant language
Go
Stars
125
Forks
36
Avg merge
1d 5h
Merged PRs (30d)
10

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.