{"record":{"id":"d76cb993e2a8a417","repo":"ory/hydra","slug":"jsonnetsecure-marshal","errorCode":null,"errorMessage":"jsonnetsecure: marshal","messagePattern":"jsonnetsecure: marshal","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/jsonnetsecure/jsonnet_pool.go","lineNumber":259,"sourceCode":"\t\treturn \"\", ctx.Err()\n\tcase output := <-w.stdout:\n\t\treturn output, nil\n\tcase err := <-w.stderr:\n\t\treturn \"\", errors.New(err)\n\t}\n}\n\nfunc (vm *processPoolVM) EvaluateAnonymousSnippet(filename string, snippet string) (_ string, err error) {\n\ttracer := trace.SpanFromContext(vm.ctx).TracerProvider().Tracer(\"\")\n\tctx, span := tracer.Start(vm.ctx, \"jsonnetsecure.processPoolVM.EvaluateAnonymousSnippet\", trace.WithAttributes(attribute.String(\"filename\", filename)))\n\tdefer otelx.End(span, &err)\n\n\tparams := vm.params\n\tparams.Filename = filename\n\tparams.Snippet = snippet\n\tpp, err := json.Marshal(params)\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"jsonnetsecure: marshal\")\n\t}\n\n\tctx = context.WithValue(ctx, contextValuePath, vm.path)\n\tctx = context.WithValue(ctx, contextValueArgs, vm.args)\n\tworker, err := vm.pool.puddle.Acquire(ctx)\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"jsonnetsecure: acquire\")\n\t}\n\n\tctx, cancel := context.WithTimeoutCause(ctx, 1*time.Second, errors.Errorf(\"failed to run jsonnet within 1s: filename=%s\", filename))\n\tdefer cancel()\n\tresult, err := worker.Value().eval(ctx, pp)\n\tif err != nil {\n\t\tworker.Destroy()\n\t\treturn \"\", errors.Wrap(err, \"jsonnetsecure: eval\")\n\t} else {\n\t\tworker.Release()\n\t}","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/jsonnetsecure/jsonnet_pool.go#L241-L277","documentation":"`EvaluateAnonymousSnippet` marshals the processParameters struct (filename, snippet, ext/TLA vars) to JSON before sending it to a worker; if `json.Marshal` fails, this wrapped error is returned. This is nearly impossible with plain string fields and would indicate an unusable parameter value or a programming error.","triggerScenarios":"Calling `EvaluateAnonymousSnippet` (directly or via the jsonnetsecure VM API) where `json.Marshal(params)` errors — practically only if params contains something json cannot encode; with current string-only fields this should never happen in normal use.","commonSituations":"Custom builds where processParameters gained a field with an unsupported type (chan, func, cyclic structure); extreme cases like invalid UTF-8 in strings generally still marshal (with replacement), so real occurrences point to code changes.","solutions":["Inspect the wrapped cause (`errors.Cause(err)`) — it names the exact json unsupported-type error","Audit recent changes to processParameters for fields that encoding/json cannot serialize; add json tags or remove them","Log filename/snippet length to confirm which call site produced the bad params","If using a forked/older version, upgrade to a release where params are JSON-safe"],"exampleFix":"// before: unserializable field added to params\ntype processParameters struct {\n    Filename string `json:\"filename\"`\n    Callback func() `json:\"callback\"` // unsupported\n}\n// after: keep params JSON-encodable (or exclude the field)\ntype processParameters struct {\n    Filename string `json:\"filename\"`\n    Callback func() `json:\"-\"` // never marshaled\n}","handlingStrategy":"type-guard","validationCode":"func paramsJSONSafe(params processParameters) error {\n    _, err := json.Marshal(params)\n    return err // run before relying on the VM\n}","typeGuard":"func validSnippetParams(filename, snippet string) bool {\n    return utf8.ValidString(filename) && utf8.ValidString(snippet)\n}","tryCatchPattern":"pp, err := json.Marshal(params)\nif err != nil {\n    return \"\", fmt.Errorf(\"jsonnetsecure: marshal: %w — check processParameters for unsupported field types\", err)\n}","preventionTips":["Keep processParameters limited to JSON-native field types; add `json:\"-\"` to anything else","Add a unit test that marshals processParameters with representative values","When extending params, re-run marshal tests in CI","Log params shape (not content) at debug level to identify offending call sites"],"tags":["go","json","serialization","jsonnet"],"backgroundTag":"json-marshal-failed","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}