{"record":{"id":"4b81cd4a0d305c16","repo":"ory/hydra","slug":"errors-new-err","errorCode":null,"errorMessage":"errors.New(err)","messagePattern":"errors\\.New\\(err\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"oryx/jsonnetsecure/jsonnet_pool.go","lineNumber":245,"sourceCode":"\t\t\t\tattribute.Int64(\"jsonnet.worker.runqueue_wait_us\", (after.runqueueWait-before.runqueueWait).Microseconds()),\n\t\t\t)\n\t\t}()\n\t}\n\n\tselect {\n\tcase <-ctx.Done():\n\t\treturn \"\", ctx.Err()\n\tcase w.stdin <- processParams:\n\t\tbreak\n\t}\n\n\tselect {\n\tcase <-ctx.Done():\n\t\treturn \"\", ctx.Err()\n\tcase output := <-w.stdout:\n\t\treturn output, nil\n\tcase err := <-w.stderr:\n\t\treturn \"\", errors.New(err)\n\t}\n}\n\nfunc (vm *processPoolVM) EvaluateAnonymousSnippet(filename string, snippet string) (_ string, err error) {\n\ttracer := trace.SpanFromContext(vm.ctx).TracerProvider().Tracer(\"\")\n\tctx, span := tracer.Start(vm.ctx, \"jsonnetsecure.processPoolVM.EvaluateAnonymousSnippet\", trace.WithAttributes(attribute.String(\"filename\", filename)))\n\tdefer otelx.End(span, &err)\n\n\tparams := vm.params\n\tparams.Filename = filename\n\tparams.Snippet = snippet\n\tpp, err := json.Marshal(params)\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"jsonnetsecure: marshal\")\n\t}\n\n\tctx = context.WithValue(ctx, contextValuePath, vm.path)\n\tctx = context.WithValue(ctx, contextValueArgs, vm.args)","sourceCodeStart":227,"sourceCodeEnd":263,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/jsonnetsecure/jsonnet_pool.go#L227-L263","documentation":"In worker.eval (oryx/jsonnetsecure/jsonnet_pool.go:245), when the worker process writes to its stderr pipe, the scanner forwards the text on the stderr channel and eval converts it verbatim into an error via errors.New(err). This is how Jsonnet compile/runtime errors of the evaluated snippet are surfaced to the caller of EvaluateAnonymousSnippet.","triggerScenarios":"Evaluating a Jsonnet snippet that fails to parse, references undefined variables, has a runtime error (assertion failure, division by zero), or exceeds the 1 KiB stderr limit (yielding 'ERROR: scan: ...'); also when the worker emits anything on stderr for any reason.","commonSituations":"Tenant-supplied Jsonnet with syntax mistakes; snippets using unsupported imports (importer is disabled); snippets exceeding output limits (256 KiB stdout produces an 'ERROR: ' prefixed result, 1 KiB stderr is truncated); the eval is also aborted by the 1-second context timeout, which returns ctx.Err() instead.","solutions":["Validate the snippet before evaluation (lint with an in-process jsonnet VM on trusted input, or parse-check).","Read the returned error text — it is the raw Jsonnet error message; fix the snippet accordingly.","Check EvaluateAnonymousSnippet's inputs: ext/TLA variables passed must be valid Jsonnet code (ExtCode/TLACode are evaluated, not literals — malformed code surfaces as a snippet error).","If the message is 'ERROR: scan: ...', reduce output size or stderr volume of the snippet; if it is a timeout, optimize or split the evaluation."],"exampleFix":"// before: ExtCode value treated as code, causing a jsonnet error\nvm.ExtCode(\"payload\", rawJSONString) // interpreted as Jsonnet, may fail\n\n// after: quote it, or pass as a variable\nvm.ExtCode(\"payload\", fmt.Sprintf(\"%q\", rawJSONString))\n// or\nvm.ExtVar(\"payload\", rawJSONString)","handlingStrategy":"try-catch","validationCode":"// pre-validate snippet syntax with an in-process VM on trusted input\nlinter := jsonnetsecure.MakeInProcessVM()\nif _, err := linter.EvaluateAnonymousSnippet(filename, snippet); err != nil {\n    return fmt.Errorf(\"invalid jsonnet snippet: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"out, err := vm.EvaluateAnonymousSnippet(filename, snippet)\nif err != nil {\n    // err text is the raw Jsonnet error from the worker's stderr\n    return fmt.Errorf(\"jsonnet evaluation failed for %s: %w\", filename, err)\n}\nif strings.HasPrefix(out, \"ERROR: \") {\n    return fmt.Errorf(\"jsonnet output problem: %s\", out)\n}","preventionTips":["Validate tenant-supplied Jsonnet before evaluation and return friendly parse errors.","Remember ExtCode/TLACode values are Jsonnet code — pass raw data via ExtVar/TLAVar or quote it.","Respect the 256 KiB output / 1 KiB stderr limits; keep snippets small.","Set an evaluation-friendly context (the VM applies a 1s timeout); budget long computations accordingly."],"tags":["jsonnet","snippet-evaluation","stderr","user-input"],"backgroundTag":"jsonnet-evaluation-failed","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}