fix: nil pointer panic in AWS ALB provider crashes process (#743)

* fix: nil pointer dereference in ALB provider crashes process

lb.DNSName and target.Target.Id can be nil for internal/failed ALBs.
Dereferencing without check at alb.go:66 panics in a nested goroutine,
crashing the entire Aurora pod and leaving enumerations stuck in queued.

Confirmed via prod crash log: goroutine 4511917 panicked in
listELBV2Resources at alb.go:66 for Group1001 customer (user 349180).

* fix: nil pointer dereference in Classic ELB provider

Same pattern as ALB — lb.DNSName and instance.InstanceId can be nil.

* fix: add panic recovery to all AWS provider goroutines

A panic in any nested goroutine (e.g., nil pointer from unexpected AWS
API response) crashes the entire process. Add defer/recover to worker()
and all GetResource goroutines so panics are logged but don't kill the
process.

Root cause of Group1001 incident: alb.go goroutine panicked, no
recovery existed, Aurora pod crashed, enumeration stuck in queued.

* chore: remove investigation debug logging and temp files

Remove [cloudlist-debug] prints from aws.go and instances.go,
clean up debug variables (workerCount, totalGoroutines) added
during Group1001 incident investigation.

* chore: remove investigation debug logging and temp files

Remove [cloudlist-debug] prints from aws.go and instances.go,
clean up debug variables (workerCount, totalGoroutines) added
during Group1001 incident investigation.

* chore: remove plan docs

* fix: address PR review — propagate worker panics, fix ec2Client nil check

- Resources() now logs worker errors and returns error when all workers fail
  instead of silently swallowing panic-derived errors
- Inner GetResource goroutines collect panics into error slice instead of
  just logging — returns error if all goroutines failed
- elb.go: fix wrong nil check (ep.elbClient → ec2Client parameter)
- recovery_test.go: add t.Parallel() to all tests

* fix: track successful workers instead of inferring from resource count

Author: knakul853

.gitignore

@@ -14,3 +14,4 @@ test-*.yaml
 /cloudlist
 /terraform/
 azure-readonly-config.yaml
+docs/superpowers/

pkg/providers/aws/alb.go

@@ -33,6 +33,7 @@ func (ep *elbV2Provider) GetResource(ctx context.Context) (*schema.Resources, er
 	list := schema.NewResources()
 	var wg sync.WaitGroup
 	var mu sync.Mutex
+	var errs []error
 
 	for _, region := range ep.regions.Regions {
 		albClients, ec2Clients := ep.getElbV2AndEc2Clients(region.RegionName)
@@ -41,6 +42,13 @@ func (ep *elbV2Provider) GetResource(ctx context.Context) (*schema.Resources, er
 
 			go func(albClient *elbv2.ELBV2, ec2Client *ec2.EC2) {
 				defer wg.Done()
+				defer func() {
+					if r := recover(); r != nil {
+						mu.Lock()
+						errs = append(errs, fmt.Errorf("panic in alb provider: %v", r))
+						mu.Unlock()
+					}
+				}()
 
 				if resources, err := ep.listELBV2Resources(albClient, ec2Client); err == nil {
 					mu.Lock()
@@ -51,6 +59,9 @@ func (ep *elbV2Provider) GetResource(ctx context.Context) (*schema.Resources, er
 		}
 	}
 	wg.Wait()
+	if len(errs) > 0 && len(list.Items) == 0 {
+		return nil, fmt.Errorf("alb: all workers failed: %v", errs)
+	}
 	return list, nil
 }
 
@@ -63,6 +74,9 @@ func (ep *elbV2Provider) listELBV2Resources(albClient *elbv2.ELBV2, ec2Client *e
 	}
 
 	for _, lb := range loadBalancers {
+		if lb.DNSName == nil || lb.LoadBalancerName == nil {
+			continue
+		}
 		albDNS := *lb.DNSName
 
 		// Extract metadata for this load balancer
@@ -101,6 +115,9 @@ func (ep *elbV2Provider) listELBV2Resources(albClient *elbv2.ELBV2, ec2Client *e
 			}
 
 			for _, target := range targets.TargetHealthDescriptions {
+				if target.Target == nil || target.Target.Id == nil {
+					continue
+				}
 				instanceID := *target.Target.Id
 				instanceOutput, err := ec2Client.DescribeInstances(&ec2.DescribeInstancesInput{
 					InstanceIds: []*string{&instanceID},

pkg/providers/aws/alb_test.go

@@ -0,0 +1,109 @@
+package aws
+
+import (
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/elbv2"
+	"github.com/projectdiscovery/cloudlist/pkg/schema"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// processLoadBalancersForTest mirrors the nil-safe loop in listELBV2Resources
+// so we can exercise the guard logic without a live AWS client.
+func processLoadBalancersForTest(lbs []*elbv2.LoadBalancer) *schema.Resources {
+	list := schema.NewResources()
+	for _, lb := range lbs {
+		if lb.DNSName == nil || lb.LoadBalancerName == nil {
+			continue
+		}
+		list.Append(&schema.Resource{
+			Provider: "aws",
+			ID:       *lb.LoadBalancerName,
+			DNSName:  *lb.DNSName,
+			Public:   true,
+			Service:  "alb",
+		})
+	}
+	return list
+}
+
+// processTargetsForTest mirrors the nil-safe target loop in listELBV2Resources.
+func processTargetsForTest(targets []*elbv2.TargetHealthDescription) []string {
+	var ids []string
+	for _, target := range targets {
+		if target.Target == nil || target.Target.Id == nil {
+			continue
+		}
+		ids = append(ids, *target.Target.Id)
+	}
+	return ids
+}
+
+func TestListELBV2Resources_NilDNSName(t *testing.T) {
+	t.Parallel()
+
+	lbs := []*elbv2.LoadBalancer{
+		{
+			DNSName:         nil,
+			LoadBalancerName: aws.String("internal-lb"),
+			LoadBalancerArn: aws.String("arn:aws:elasticloadbalancing:us-east-1:123456789:loadbalancer/app/internal-lb/abc"),
+		},
+		{
+			DNSName:         aws.String(""),
+			LoadBalancerName: nil,
+		},
+	}
+
+	require.NotPanics(t, func() {
+		resources := processLoadBalancersForTest(lbs)
+		assert.Equal(t, 0, len(resources.Items), "nil DNSName or LoadBalancerName LBs must be skipped")
+	})
+}
+
+func TestListELBV2Resources_ValidLB(t *testing.T) {
+	t.Parallel()
+
+	lbs := []*elbv2.LoadBalancer{
+		{
+			DNSName:         aws.String("my-lb-1234567890.us-east-1.elb.amazonaws.com"),
+			LoadBalancerName: aws.String("my-lb"),
+			LoadBalancerArn: aws.String("arn:aws:elasticloadbalancing:us-east-1:123456789:loadbalancer/app/my-lb/abc"),
+		},
+		{
+			DNSName:         nil,
+			LoadBalancerName: aws.String("broken-lb"),
+		},
+	}
+
+	resources := processLoadBalancersForTest(lbs)
+	require.Equal(t, 1, len(resources.Items))
+	assert.Equal(t, "my-lb-1234567890.us-east-1.elb.amazonaws.com", resources.Items[0].DNSName)
+	assert.Equal(t, "my-lb", resources.Items[0].ID)
+}
+
+func TestListELBV2Resources_NilTargetId(t *testing.T) {
+	t.Parallel()
+
+	targets := []*elbv2.TargetHealthDescription{
+		{
+			Target: nil,
+		},
+		{
+			Target: &elbv2.TargetDescription{
+				Id: nil,
+			},
+		},
+		{
+			Target: &elbv2.TargetDescription{
+				Id: aws.String("i-0abc123def456"),
+			},
+		},
+	}
+
+	require.NotPanics(t, func() {
+		ids := processTargetsForTest(targets)
+		assert.Equal(t, []string{"i-0abc123def456"}, ids)
+	})
+}

pkg/providers/aws/aws.go

@@ -435,6 +435,11 @@ type result struct {
 type getResourcesFunc func(context.Context) (*schema.Resources, error)
 
 func worker(ctx context.Context, fn getResourcesFunc, ch chan<- result) {
+	defer func() {
+		if r := recover(); r != nil {
+			ch <- result{resources: nil, err: fmt.Errorf("panic in provider worker: %v", r)}
+		}
+	}()
 	resources, err := fn(ctx)
 	ch <- result{resources, err}
 }
@@ -497,17 +502,26 @@ func (p *Provider) Resources(ctx context.Context) (*schema.Resources, error) {
 		assignWorker(cloudfrontProvider.GetResource)
 	}
 
+
 	go func() {
 		workersWaitGroup.Wait()
 		close(results)
 	}()
 
+	var errs []error
+	successfulWorkers := 0
 	for result := range results {
 		if result.err != nil {
+			gologger.Warning().Msgf("provider worker error: %v", result.err)
+			errs = append(errs, result.err)
 			continue
 		}
+		successfulWorkers++
 		finalResources.Merge(result.resources)
 	}
+	if len(errs) > 0 && successfulWorkers == 0 {
+		return finalResources, fmt.Errorf("all provider workers failed: %v", errs)
+	}
 	return finalResources, nil
 }
 

pkg/providers/aws/cloudfront.go

@@ -31,12 +31,20 @@ func (cp *cloudfrontProvider) GetResource(ctx context.Context) (*schema.Resource
 	list := schema.NewResources()
 	var wg sync.WaitGroup
 	var mu sync.Mutex
+	var errs []error
 
 	for _, client := range cp.getCloudfrontClients() {
 		wg.Add(1)
 
 		go func(cloudfrontClient *cloudfront.CloudFront) {
 			defer wg.Done()
+			defer func() {
+				if r := recover(); r != nil {
+					mu.Lock()
+					errs = append(errs, fmt.Errorf("panic in cloudfront provider: %v", r))
+					mu.Unlock()
+				}
+			}()
 
 			if resources, err := cp.listCloudFrontResources(cloudfrontClient); err == nil {
 				mu.Lock()
@@ -46,6 +54,9 @@ func (cp *cloudfrontProvider) GetResource(ctx context.Context) (*schema.Resource
 		}(client)
 	}
 	wg.Wait()
+	if len(errs) > 0 && len(list.Items) == 0 {
+		return nil, fmt.Errorf("cloudfront: all workers failed: %v", errs)
+	}
 	return list, nil
 }
 

pkg/providers/aws/ecs.go

@@ -33,6 +33,7 @@ func (ep *ecsProvider) GetResource(ctx context.Context) (*schema.Resources, erro
 	list := schema.NewResources()
 	var wg sync.WaitGroup
 	var mu sync.Mutex
+	var errs []error
 
 	for _, region := range ep.regions.Regions {
 		ecsClients, ec2Clients := ep.getEcsAndEc2Clients(region.RegionName)
@@ -41,6 +42,13 @@ func (ep *ecsProvider) GetResource(ctx context.Context) (*schema.Resources, erro
 
 			go func(ecsClient *ecs.ECS, ec2Client *ec2.EC2) {
 				defer wg.Done()
+				defer func() {
+					if r := recover(); r != nil {
+						mu.Lock()
+						errs = append(errs, fmt.Errorf("panic in ecs provider: %v", r))
+						mu.Unlock()
+					}
+				}()
 				if resources, err := ep.listECSResources(ecsClient, ec2Client); err == nil {
 					mu.Lock()
 					list.Merge(resources)
@@ -50,6 +58,9 @@ func (ep *ecsProvider) GetResource(ctx context.Context) (*schema.Resources, erro
 		}
 	}
 	wg.Wait()
+	if len(errs) > 0 && len(list.Items) == 0 {
+		return nil, fmt.Errorf("ecs: all workers failed: %v", errs)
+	}
 	return list, nil
 }
 

pkg/providers/aws/eks.go

@@ -39,12 +39,20 @@ func (ep *eksProvider) GetResource(ctx context.Context) (*schema.Resources, erro
 	list := schema.NewResources()
 	var wg sync.WaitGroup
 	var mu sync.Mutex
+	var errs []error
 	for _, region := range ep.regions.Regions {
 		for _, eksClient := range ep.getEksClients(region.RegionName) {
 			wg.Add(1)
 
 			go func(client *eks.EKS) {
 				defer wg.Done()
+				defer func() {
+					if r := recover(); r != nil {
+						mu.Lock()
+						errs = append(errs, fmt.Errorf("panic in eks provider: %v", r))
+						mu.Unlock()
+					}
+				}()
 				if resources, err := ep.listEKSResources(client); err == nil {
 					mu.Lock()
 					list.Merge(resources)
@@ -54,6 +62,9 @@ func (ep *eksProvider) GetResource(ctx context.Context) (*schema.Resources, erro
 		}
 	}
 	wg.Wait()
+	if len(errs) > 0 && len(list.Items) == 0 {
+		return nil, fmt.Errorf("eks: all workers failed: %v", errs)
+	}
 	return list, nil
 }
 

pkg/providers/aws/elb.go

@@ -32,6 +32,7 @@ func (ep *elbProvider) GetResource(ctx context.Context) (*schema.Resources, erro
 	list := schema.NewResources()
 	var wg sync.WaitGroup
 	var mu sync.Mutex
+	var errs []error
 
 	for _, region := range ep.regions.Regions {
 		elbClients, ec2Clients := ep.getElbAndEc2Clients(region.RegionName)
@@ -41,6 +42,13 @@ func (ep *elbProvider) GetResource(ctx context.Context) (*schema.Resources, erro
 
 			go func(elbClient *elb.ELB, ec2Client *ec2.EC2) {
 				defer wg.Done()
+				defer func() {
+					if r := recover(); r != nil {
+						mu.Lock()
+						errs = append(errs, fmt.Errorf("panic in elb provider: %v", r))
+						mu.Unlock()
+					}
+				}()
 
 				if resources, err := ep.listELBResources(elbClient, ec2Client); err == nil {
 					mu.Lock()
@@ -51,6 +59,9 @@ func (ep *elbProvider) GetResource(ctx context.Context) (*schema.Resources, erro
 		}
 	}
 	wg.Wait()
+	if len(errs) > 0 && len(list.Items) == 0 {
+		return nil, fmt.Errorf("elb: all workers failed: %v", errs)
+	}
 	return list, nil
 }
 
@@ -63,6 +74,9 @@ func (ep *elbProvider) listELBResources(elbClient *elb.ELB, ec2Client *ec2.EC2)
 	}
 
 	for _, lb := range loadBalancerDescriptions {
+		if lb.DNSName == nil || lb.LoadBalancerName == nil {
+			continue
+		}
 		elbDNS := *lb.DNSName
 
 		// Extract metadata for this load balancer
@@ -81,11 +95,14 @@ func (ep *elbProvider) listELBResources(elbClient *elb.ELB, ec2Client *ec2.EC2)
 		}
 		list.Append(resource)
 
-		if ep.elbClient == nil {
+		if ec2Client == nil {
 			continue
 		}
 		// Describe Instances for the Load Balancer
 		for _, instance := range lb.Instances {
+			if instance.InstanceId == nil {
+				continue
+			}
 			instanceID := *instance.InstanceId
 			instanceOutput, err := ec2Client.DescribeInstances(&ec2.DescribeInstancesInput{
 				InstanceIds: []*string{&instanceID},