From 5457cc5d4f9e80a611fee104d356dd6e0976b53a Mon Sep 17 00:00:00 2001 From: Alexander Zobnin Date: Tue, 30 Sep 2025 09:56:08 +0200 Subject: [PATCH] Authz: Fix zookie nil pointer dereference (#111758) --- pkg/services/authz/rbac/service.go | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/pkg/services/authz/rbac/service.go b/pkg/services/authz/rbac/service.go index 0650fd7daf5..105f7db7157 100644 --- a/pkg/services/authz/rbac/service.go +++ b/pkg/services/authz/rbac/service.go @@ -232,12 +232,18 @@ func (s *Service) List(ctx context.Context, req *authzv1.ListRequest) (*authzv1. } resp, err := s.listPermission(ctx, permissions, listReq) - if cacheHit && time.Duration(time.Now().Unix()-resp.Zookie.Timestamp) < s.settings.CacheTTL { - resp.Zookie = &authzv1.Zookie{Timestamp: time.Now().Add(-s.settings.CacheTTL).Unix()} + s.metrics.requestCount.WithLabelValues(strconv.FormatBool(err != nil), "true", req.GetVerb(), req.GetGroup(), req.GetResource()).Inc() + if err != nil { + return nil, err } - s.metrics.requestCount.WithLabelValues(strconv.FormatBool(err != nil), "true", req.GetVerb(), req.GetGroup(), req.GetResource()).Inc() - return resp, err + if resp != nil && resp.Zookie != nil { + if cacheHit && time.Duration(time.Now().Unix()-resp.Zookie.Timestamp) < s.settings.CacheTTL { + resp.Zookie = &authzv1.Zookie{Timestamp: time.Now().Add(-s.settings.CacheTTL).Unix()} + } + } + + return resp, nil } func (s *Service) validateCheckRequest(ctx context.Context, req *authzv1.CheckRequest) (*checkRequest, error) {