{"record":{"id":"60b6c901bda8d065","repo":"owasp-amass/amass","slug":"failed-to-obtain-the-subject-contact-record","errorCode":null,"errorMessage":"failed to obtain the subject contact record","messagePattern":"failed to obtain the subject contact record","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"engine/plugins/horizontals/tls_cert.go","lineNumber":48,"sourceCode":"\tif !ok {\n\t\treturn errors.New(\"failed to cast the TLSCertificate asset\")\n\t}\n\n\t// check if scope expansion is allowed\n\tif e.Session.Config().Rigid {\n\t\treturn nil\n\t}\n\n\tif orgs, err := h.lookup(e.Session, e.Entity); err == nil && len(orgs) > 0 {\n\t\th.process(e, c, orgs)\n\t}\n\treturn nil\n}\n\nfunc (h *horTlsCert) lookup(sess et.Session, tlsent *dbt.Entity) ([]*dbt.Entity, error) {\n\tcr, err := h.plugin.getContactRecord(sess, tlsent, \"subject_contact\")\n\tif err != nil {\n\t\treturn nil, errors.New(\"failed to obtain the subject contact record\")\n\t}\n\n\torgs, err := h.plugin.getContactRecordOrganizations(sess, cr)\n\tif err != nil {\n\t\treturn nil, errors.New(\"failed to obtain the subject organizations\")\n\t}\n\n\treturn orgs, nil\n}\n\nfunc (h *horTlsCert) process(e *et.Event, c *oamcert.TLSCertificate, orgs []*dbt.Entity) {\n\t// check if the TLS certificate subject common name is in scope\n\tif _, conf := e.Session.Scope().IsAssetInScope(&oamdns.FQDN{Name: c.SubjectCommonName}, 0); conf > 0 {\n\t\treturn\n\t}\n\n\tvar found bool\n\tfor _, o := range orgs {","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/owasp-amass/amass/blob/79299dce87b0085db0f2f4ef3e9c52cccb49f514/engine/plugins/horizontals/tls_cert.go#L30-L66","documentation":"horTlsCert.lookup calls getContactRecord(sess, tlsent, \"subject_contact\") to fetch the certificate's subject contact entity from the graph; when that returns an error, the underlying cause is discarded and this generic error is raised. It means no subject contact relation was found (or the lookup failed) for the TLS certificate entity.","triggerScenarios":"A TLSCertificate entity exists in the graph but has no subject_contact relation to a ContactRecord — e.g. the certificate data source did not provide subject contact info, or getContactRecord's DB query fails and its error is swallowed here.","commonSituations":"Certificates scraped from sources lacking contact metadata; running with data sources disabled so contact records are never created; relations pruned by TTL cleanup before the horizontals plugin processes the certificate.","solutions":["Wrap the original error instead of discarding it: fmt.Errorf(\"failed to obtain the subject contact record: %w\", err) to see the real cause","Verify the data sources that create subject_contact relations are enabled in config","Make lookup tolerant: if the contact record is missing, return (nil, nil) and skip scope-expansion processing"],"exampleFix":"// before\ncr, err := h.plugin.getContactRecord(sess, tlsent, \"subject_contact\")\nif err != nil {\n\treturn nil, errors.New(\"failed to obtain the subject contact record\")\n}\n\n// after\ncr, err := h.plugin.getContactRecord(sess, tlsent, \"subject_contact\")\nif err != nil {\n\tif errors.Is(err, dbt.ErrNotFound) {\n\t\treturn nil, nil\n\t}\n\treturn nil, fmt.Errorf(\"failed to obtain the subject contact record: %w\", err)\n}","handlingStrategy":"fallback","validationCode":"var cr *dbt.Entity\nents, _ := sess.DB().FindEntitiesByContent(ctx, oam.ContactRecord, time.Time{}, 1, filters)\nif len(ents) == 0 {\n\treturn nil, nil // no subject contact; skip expansion\n}","typeGuard":null,"tryCatchPattern":"orgs, err := h.lookup(sess, tlsent)\nif err != nil {\n\tlog.WithError(err).Debug(\"no subject contact record; skipping TLS expansion\")\n\treturn nil\n}","preventionTips":["Enable the data sources that create subject_contact relations","Wrap underlying errors with %w so causes are diagnosable","Check relation existence in the graph before TLS-driven scope expansion"],"tags":["go","graph-database","missing-relation"],"backgroundTag":"entity-not-found","analyzedSha":"79299dce87b0085db0f2f4ef3e9c52cccb49f514","analyzedAt":"2026-09-06T08:22:48.198Z","contentChangedAt":"2026-09-06T08:22:48.198Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}