[GH-ISSUE #1847] panic on webhook when not having a project with the id same as webhook creator #6493

Closed
opened 2026-04-20 17:05:45 -05:00 by GiteaMirror · 1 comment
Owner

Originally created by @imlonghao on GitHub (Nov 19, 2025).
Original GitHub issue: https://github.com/go-vikunja/vikunja/issues/1847

Originally assigned to: @Copilot on GitHub.

Description

I'm testing whether #1724 was fixed and then found out the webhook trigger time turn from 3 to 0.

ERROR log was found.

Error while handling message f0555d8c-8673-4d72-bbed-87e335be2a7b, reason_poisoned=panic occurred: "invalid memory address or nil pointer dereference", stacktrace:
goroutine 492 [running]:
runtime/debug.Stack()
        /go/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.4.linux-amd64/src/runtime/debug/stack.go:26 +0x5e
github.com/ThreeDotsLabs/watermill/message/router/middleware.Recoverer.func1.1()
        /go/pkg/mod/github.com/!three!dots!labs/watermill@v1.5.1/message/router/middleware/recoverer.go:29 +0x50
panic({0x1bca960?, 0x3a0a910?})
        /go/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.4.linux-amd64/src/runtime/panic.go:783 +0x132
code.vikunja.io/api/pkg/models.(*Project).ReadOne(0xc00163b380?, 0x1?, {0x2b967c0?, 0xc001599848?})
        /go/src/code.vikunja.io/api/pkg/models/project.go:282 +0x1c
code.vikunja.io/api/pkg/models.(*WebhookListener).Handle(0xc000b80130, 0xc000c81b60)
        /go/src/code.vikunja.io/api/pkg/models/listeners.go:1026 +0x87c
github.com/ThreeDotsLabs/watermill/message.(*Router).AddConsumerHandler.func1(0x5715e4?)
        /go/pkg/mod/github.com/!three!dots!labs/watermill@v1.5.1/message/router.go:349 +0x17
github.com/ThreeDotsLabs/watermill/message/router/middleware.Recoverer.func1(0xc001599b3c?)
        /go/pkg/mod/github.com/!three!dots!labs/watermill@v1.5.1/message/router/middleware/recoverer.go:33 +0x70
github.com/ThreeDotsLabs/watermill/message/router/middleware.Retry.Middleware-fm.Retry.Middleware.func1.2()
        /go/pkg/mod/github.com/!three!dots!labs/watermill@v1.5.1/message/router/middleware/retry.go:104 +0x9e
github.com/cenkalti/backoff/v5.Retry[...]({0x2ba73a0?, 0xc0008804b0}, 0xc000eb0fc0, {0xc000d20820, 0x4, 0x481e05})
        /go/pkg/mod/github.com/cenkalti/backoff/v5@v5.0.3/retry.go:87 +0x207
github.com/ThreeDotsLabs/watermill/message/router/middleware.Retry.Middleware-fm.Retry.Middleware.func1(0xc000c81b60)
        /go/pkg/mod/github.com/!three!dots!labs/watermill@v1.5.1/message/router/middleware/retry.go:127 +0x351
github.com/ThreeDotsLabs/watermill/message/router/middleware.poisonQueue.Middleware-fm.poisonQueue.Middleware.func1(0x1c49ac0?)
        /go/pkg/mod/github.com/!three!dots!labs/watermill@v1.5.1/message/router/middleware/poison.go:100 +0xa2
github.com/ThreeDotsLabs/watermill/components/metrics.HandlerPrometheusMetricsMiddleware.Middleware-fm.HandlerPrometheusMetricsMiddleware.Middleware.func1(0xc000c81b60)
        /go/pkg/mod/github.com/!three!dots!labs/watermill@v1.5.1/components/metrics/handler.go:62 +0x2e8
github.com/ThreeDotsLabs/watermill/message.(*handler).handleMessage(0xc0006cc0d0, 0xc000c81b60, 0xc000b68270)
        /go/pkg/mod/github.com/!three!dots!labs/watermill@v1.5.1/message/router.go:824 +0x1cc
created by github.com/ThreeDotsLabs/watermill/message.(*handler).run in goroutine 322
        /go/pkg/mod/github.com/!three!dots!labs/watermill@v1.5.1/message/router.go:670 +0x2a8
, topic_poisoned=task.updated, handler_poisoned=task.updated.webhook.listener, subscriber_poisoned=gochannel.GoChannel,  payload=**REDACATED**

79aaa2a906/pkg/models/listeners.go (L1022)

It should be webhook.ProjectID not webhook.CreatedByID

79aaa2a906/pkg/models/listeners.go (L1022-L1026)

The project may be nil, causing 79aaa2a906/pkg/models/project.go (L282) p.ID panic.

Vikunja Version

v1.0.0-rc2-302-5f795bb5

Browser and version

No response

Can you reproduce the bug on the Vikunja demo site?

Yes

Screenshots

No response

Originally created by @imlonghao on GitHub (Nov 19, 2025). Original GitHub issue: https://github.com/go-vikunja/vikunja/issues/1847 Originally assigned to: @Copilot on GitHub. ### Description I'm testing whether #1724 was fixed and then found out the webhook trigger time turn from 3 to 0. ERROR log was found. ``` Error while handling message f0555d8c-8673-4d72-bbed-87e335be2a7b, reason_poisoned=panic occurred: "invalid memory address or nil pointer dereference", stacktrace: goroutine 492 [running]: runtime/debug.Stack() /go/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.4.linux-amd64/src/runtime/debug/stack.go:26 +0x5e github.com/ThreeDotsLabs/watermill/message/router/middleware.Recoverer.func1.1() /go/pkg/mod/github.com/!three!dots!labs/watermill@v1.5.1/message/router/middleware/recoverer.go:29 +0x50 panic({0x1bca960?, 0x3a0a910?}) /go/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.4.linux-amd64/src/runtime/panic.go:783 +0x132 code.vikunja.io/api/pkg/models.(*Project).ReadOne(0xc00163b380?, 0x1?, {0x2b967c0?, 0xc001599848?}) /go/src/code.vikunja.io/api/pkg/models/project.go:282 +0x1c code.vikunja.io/api/pkg/models.(*WebhookListener).Handle(0xc000b80130, 0xc000c81b60) /go/src/code.vikunja.io/api/pkg/models/listeners.go:1026 +0x87c github.com/ThreeDotsLabs/watermill/message.(*Router).AddConsumerHandler.func1(0x5715e4?) /go/pkg/mod/github.com/!three!dots!labs/watermill@v1.5.1/message/router.go:349 +0x17 github.com/ThreeDotsLabs/watermill/message/router/middleware.Recoverer.func1(0xc001599b3c?) /go/pkg/mod/github.com/!three!dots!labs/watermill@v1.5.1/message/router/middleware/recoverer.go:33 +0x70 github.com/ThreeDotsLabs/watermill/message/router/middleware.Retry.Middleware-fm.Retry.Middleware.func1.2() /go/pkg/mod/github.com/!three!dots!labs/watermill@v1.5.1/message/router/middleware/retry.go:104 +0x9e github.com/cenkalti/backoff/v5.Retry[...]({0x2ba73a0?, 0xc0008804b0}, 0xc000eb0fc0, {0xc000d20820, 0x4, 0x481e05}) /go/pkg/mod/github.com/cenkalti/backoff/v5@v5.0.3/retry.go:87 +0x207 github.com/ThreeDotsLabs/watermill/message/router/middleware.Retry.Middleware-fm.Retry.Middleware.func1(0xc000c81b60) /go/pkg/mod/github.com/!three!dots!labs/watermill@v1.5.1/message/router/middleware/retry.go:127 +0x351 github.com/ThreeDotsLabs/watermill/message/router/middleware.poisonQueue.Middleware-fm.poisonQueue.Middleware.func1(0x1c49ac0?) /go/pkg/mod/github.com/!three!dots!labs/watermill@v1.5.1/message/router/middleware/poison.go:100 +0xa2 github.com/ThreeDotsLabs/watermill/components/metrics.HandlerPrometheusMetricsMiddleware.Middleware-fm.HandlerPrometheusMetricsMiddleware.Middleware.func1(0xc000c81b60) /go/pkg/mod/github.com/!three!dots!labs/watermill@v1.5.1/components/metrics/handler.go:62 +0x2e8 github.com/ThreeDotsLabs/watermill/message.(*handler).handleMessage(0xc0006cc0d0, 0xc000c81b60, 0xc000b68270) /go/pkg/mod/github.com/!three!dots!labs/watermill@v1.5.1/message/router.go:824 +0x1cc created by github.com/ThreeDotsLabs/watermill/message.(*handler).run in goroutine 322 /go/pkg/mod/github.com/!three!dots!labs/watermill@v1.5.1/message/router.go:670 +0x2a8 , topic_poisoned=task.updated, handler_poisoned=task.updated.webhook.listener, subscriber_poisoned=gochannel.GoChannel, payload=**REDACATED** ``` https://github.com/go-vikunja/vikunja/blob/79aaa2a906d960b4f14571b79363d3a1a731c426/pkg/models/listeners.go#L1022 It should be `webhook.ProjectID` not `webhook.CreatedByID` https://github.com/go-vikunja/vikunja/blob/79aaa2a906d960b4f14571b79363d3a1a731c426/pkg/models/listeners.go#L1022-L1026 The `project` may be nil, causing https://github.com/go-vikunja/vikunja/blob/79aaa2a906d960b4f14571b79363d3a1a731c426/pkg/models/project.go#L282 `p.ID` panic. ### Vikunja Version v1.0.0-rc2-302-5f795bb5 ### Browser and version _No response_ ### Can you reproduce the bug on the Vikunja demo site? Yes ### Screenshots _No response_
Author
Owner

@kolaente commented on GitHub (Nov 19, 2025):

Fixed in https://github.com/go-vikunja/vikunja/pull/1848, please check with the next unstable build (should be ready for deployment in ~30min, also on try).

<!-- gh-comment-id:3553507259 --> @kolaente commented on GitHub (Nov 19, 2025): Fixed in https://github.com/go-vikunja/vikunja/pull/1848, please check with the next unstable build (should be ready for deployment in ~30min, also on [try](https://try.vikunja.io)).
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#6493