goharbor/harbor · error

nil scan report object

Error message

nil scan report object

What it means

Returned by basicManager.Create when the *scan.Report argument is nil. The manager validates the report object before assigning a UUID and inserting; a nil pointer is rejected immediately.

Source

Thrown at src/pkg/scan/report/manager.go:129

// basicManager is a default implementation of report manager.
type basicManager struct {
	dao     scan.DAO
	vulnDao scan.VulnerabilityRecordDao
}

// NewManager news basic manager.
func NewManager() Manager {
	return &basicManager{
		dao:     scan.New(),
		vulnDao: scan.NewVulnerabilityRecordDao(),
	}
}

// Create ...
func (bm *basicManager) Create(ctx context.Context, r *scan.Report) (string, error) {
	// Validate report object
	if r == nil {
		return "", errors.New("nil scan report object")
	}

	if len(r.Digest) == 0 || len(r.RegistrationUUID) == 0 || len(r.MimeType) == 0 {
		return "", errors.New("malformed scan report object")
	}

	r.UUID = uuid.New().String()

	// Insert
	if _, err := bm.dao.Create(ctx, r); err != nil {
		return "", err
	}

	return r.UUID, nil
}

func (bm *basicManager) Delete(ctx context.Context, uuid string) error {
	_, err := bm.vulnDao.DeleteForReport(ctx, uuid)

View on GitHub (pinned to 7b2fd08cc5)

Solutions

1. Construct the scan.Report before calling Create: set Digest, RegistrationUUID, MimeType
2. Check errors from any unmarshal/lookup that produces the report before passing it on
3. Add a nil guard at call sites to return a clearer caller-side error

Example fix

// before
var r *scan.Report
_ = json.Unmarshal(data, r) // fails, r stays nil
uuid, err := bm.Create(ctx, r)

// after
r := new(scan.Report)
if err := json.Unmarshal(data, r); err != nil {
    return err
}
uuid, err := bm.Create(ctx, r)

if r == nil {
    return errors.New("cannot create a nil scan report")
}
uuid, err := bm.Create(ctx, r)

func isReportReadyForCreate(r *scan.Report) bool {
    return r != nil
}

When it happens

Trigger: Calling report.Mgr.Create(ctx, nil) directly; a caller unmarshaling a report from JSON into an uninitialized pointer that stays nil on error paths; nil returned by a lookup then passed straight to Create.

Common situations: Internal code or plugins building reports conditionally and skipping construction; error paths where an earlier unmarshal failed but the nil result was still forwarded.

Related errors

• File {} not exist
• Internal dir for tls {} not exist
• malformed scan report object
• empty digest to get report data
• missing uuid

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/5e17075191248c2c. Report an issue: GitHub.