{"record":{"id":"de4378385fbeb14f","repo":"direnv/direnv","slug":"unsupported-sri-algo","errorCode":null,"errorMessage":"unsupported SRI algo","messagePattern":"unsupported SRI algo","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/sri/writer.go","lineNumber":29,"sourceCode":"type Writer struct {\n\tw    io.Writer\n\talgo Algo\n\th    hash.Hash\n}\n\n// NewWriter returns a SRI writer that forwards the write while calculating\n// the SRI hash.\nfunc NewWriter(w io.Writer, algo Algo) Writer {\n\tvar h hash.Hash\n\tswitch algo {\n\tcase SHA256:\n\t\th = sha256.New()\n\tcase SHA384:\n\t\th = sha512.New384()\n\tcase SHA512:\n\t\th = sha512.New()\n\tdefault:\n\t\tpanic(\"unsupported SRI algo\")\n\t}\n\n\treturn Writer{w, algo, h}\n}\n\nfunc (w Writer) Write(b []byte) (int, error) {\n\t// First write to the underlying storage\n\tn, err := w.w.Write(b)\n\tif err == nil {\n\t\t// This should always succeed\n\t\t_, _ = w.h.Write(b)\n\t}\n\treturn n, err\n}\n\n// Sum returns the calculated SRI hash\nfunc (w Writer) Sum() *Hash {\n\tsum := w.h.Sum(nil)","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/direnv/direnv/blob/b00e451f547f39be7ab836d969054114a465a0f9/pkg/sri/writer.go#L11-L47","documentation":"NewWriter maps an sri.Algo to a crypto hash constructor; only SHA256, SHA384, and SHA512 are mapped. Any other Algo value falls into a default branch that panics with this message, since the Writer cannot stream an unsupported hash.","triggerScenarios":"Constructing sri.NewWriter with an Algo that bypassed Parse's validation — e.g. a zero-value Hash/Algo, a custom algo string, or refactored code that sets algo manually instead of parsing an SRI string.","commonSituations":"Programmatically building an Algo from user input without going through Parse; adding a new algo constant without extending NewWriter's switch; uninitialized struct fields defaulting to an invalid algo.","solutions":["Only pass Algo values obtained from sri.Parse or the exported SHA256/SHA384/SHA512 constants","Add a case for the new algorithm in NewWriter's switch if you genuinely extended the algo set","Validate the algo with an explicit switch or lookup before calling NewWriter instead of relying on the panic"],"exampleFix":"// before\nw := sri.NewWriter(buf, sri.Algo(\"md5\"))\n// after\nvar algo sri.Algo = sri.SHA256 // only predefined algos\nw := sri.NewWriter(buf, algo)","handlingStrategy":"type-guard","validationCode":"switch algo { case sri.SHA256, sri.SHA384, sri.SHA512: default: return errors.New(\"unsupported algo\") }","typeGuard":"func validAlgo(a sri.Algo) bool {\n    switch a { case sri.SHA256, sri.SHA384, sri.SHA512: return true }\n    return false\n}","tryCatchPattern":"defer func() { if r := recover(); r != nil { err = fmt.Errorf(\"sri writer: %v\", r) } }()\nw := sri.NewWriter(buf, algo)","preventionTips":["Only construct Algo via sri.Parse or exported constants","Never rely on zero-value Algo structs","If adding algorithms, extend NewWriter's switch and test it","Validate algo before streaming data into the writer"],"tags":["sri","panic","algorithm","hash"],"backgroundTag":"unsupported-sri-algorithm","analyzedSha":"b00e451f547f39be7ab836d969054114a465a0f9","analyzedAt":"2026-09-05T21:39:49.983Z","contentChangedAt":"2026-09-05T21:39:49.983Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}