From 9d0633268a984733b23b345d354c18256d717aa1 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Wed, 19 Nov 2025 14:43:08 +0000
Subject: [PATCH] fix: prevent panic in webhook listener when fetching project
 (#1848)

This fixes a panic that occurred when handling webhooks. The code was
incorrectly using webhook.CreatedByID (user ID) to fetch a project,
when it should use webhook.ProjectID. This could cause GetProjectSimpleByID
to return nil if no project exists with that ID.

Additionally, added a nil check before calling project.ReadOne() to prevent
a nil pointer dereference panic when accessing p.ID.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kolaente <13721712+kolaente@users.noreply.github.com>
---
 go.sum                  |  4 ----
 pkg/models/listeners.go | 16 +++++++++-------
 2 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/go.sum b/go.sum
index 4dbd6e0d5..8daf2b179 100644
--- a/go.sum
+++ b/go.sum
@@ -107,12 +107,8 @@ github.com/gabriel-vasile/mimetype v1.4.11 h1:AQvxbp830wPhHTqc1u7nzoLT+ZFxGY7emj
 github.com/gabriel-vasile/mimetype v1.4.11/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/ganigeorgiev/fexpr v0.5.0 h1:XA9JxtTE/Xm+g/JFI6RfZEHSiQlk+1glLvRK1Lpv/Tk=
 github.com/ganigeorgiev/fexpr v0.5.0/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
-github.com/getsentry/sentry-go v0.37.0 h1:5bavywHxVkU/9aOIF4fn3s5RTJX5Hdw6K2W6jLYtM98=
-github.com/getsentry/sentry-go v0.37.0/go.mod h1:eRXCoh3uvmjQLY6qu63BjUZnaBu5L5WhMV1RwYO8W5s=
 github.com/getsentry/sentry-go v0.38.0 h1:S8Xui7gLeAvXINVLMOaX94HnsDf1GexnfXGSNC4+KQs=
 github.com/getsentry/sentry-go v0.38.0/go.mod h1:eRXCoh3uvmjQLY6qu63BjUZnaBu5L5WhMV1RwYO8W5s=
-github.com/getsentry/sentry-go/echo v0.37.0 h1:Lzpg9MVmMD9jPyuKyilyDtrH6dOU3luSLSjj+r5KfVI=
-github.com/getsentry/sentry-go/echo v0.37.0/go.mod h1:wbh4ppYCgmnuoIMGu/DrQzD0NoX6vt2qfoRxMe2wkUQ=
 github.com/getsentry/sentry-go/echo v0.38.0 h1:ZKvDf3O7jXS+UoeGCBiVVB6J14XWqz+9Dtldstl7FS4=
 github.com/getsentry/sentry-go/echo v0.38.0/go.mod h1:iEsS3MBdYoeCMXeG94dhpCca0nOdhB6dMMvbk/XMvvo=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
diff --git a/pkg/models/listeners.go b/pkg/models/listeners.go
index 3b5e246b6..03a94fcd1 100644
--- a/pkg/models/listeners.go
+++ b/pkg/models/listeners.go
@@ -1019,16 +1019,18 @@ func (wl *WebhookListener) Handle(msg *message.Message) (err error) {
 	for _, webhook := range matchingWebhooks {
 
 		if _, has := event["project"]; !has {
-			project, err := GetProjectSimpleByID(s, webhook.CreatedByID)
+			project, err := GetProjectSimpleByID(s, webhook.ProjectID)
 			if err != nil && !IsErrProjectDoesNotExist(err) {
 				log.Errorf("Could not load project for webhook %d: %s", webhook.ID, err)
 			}
-			err = project.ReadOne(s, &user.User{ID: doerID})
-			if err != nil && !IsErrProjectDoesNotExist(err) {
-				log.Errorf("Could not load project for webhook %d: %s", webhook.ID, err)
-			}
-			if err == nil {
-				event["project"] = project
+			if project != nil {
+				err = project.ReadOne(s, &user.User{ID: doerID})
+				if err != nil && !IsErrProjectDoesNotExist(err) {
+					log.Errorf("Could not load project for webhook %d: %s", webhook.ID, err)
+				}
+				if err == nil {
+					event["project"] = project
+				}
 			}
 		}