Skip to content

fix(linkedin): avoid panic when the email response has no elements - #2807

Open
suvvvv wants to merge 1 commit into
supabase:masterfrom
suvvvv:fix/linkedin-empty-email-panic
Open

suvvvv wants to merge 1 commit into
supabase:masterfrom
suvvvv:fix/linkedin-empty-email-panic

Conversation

@suvvvv

@suvvvv suvvvv commented Sep 15, 2026

Copy link
Copy Markdown

What

linkedinProvider.GetUserData reads the user's email as e.Elements[0].HandleTilde.EmailAddress without checking that Elements is non-empty. When LinkedIn's /v2/emailAddress endpoint returns an empty array — e.g. when the email scope isn't granted or no primary email is available — this panics:

runtime error: index out of range [0] with length 0
  internal/api/provider/linkedin.go:128  (GetUserData)

The recoverer middleware turns the panic into a 500, so the OAuth callback fails instead of degrading gracefully. Note that getAvatarUrl a few lines above already guards its Elements access with len(...) > 0; the email path was missing the same check.

Fix

Read the email through a length-guarded local (mirroring getAvatarUrl). A missing email now yields an empty value that flows through the existing email != "" handling, so sign-in proceeds without the email rather than crashing.

Testing

Added TestSignupExternalLinkedin_MissingEmail in internal/api/external_linkedin_test.go, which drives the OAuth callback with an empty {"elements": []} email response. Before the change it fails with the recovered panic (500); after it, the callback redirects normally (302). All existing LinkedIn provider tests still pass; gofmt and go vet are clean.

GetUserData indexed e.Elements[0] without checking the slice length. When
LinkedIn's /v2/emailAddress endpoint returns an empty elements array (for
example when the email scope is not granted), this panics with "index out
of range [0] with length 0", which the recoverer turns into a 500 and
fails the OAuth callback.

Read the email through a length-guarded local, mirroring the existing
guard in getAvatarUrl, so a missing email is handled gracefully. Adds a
regression test that exercises the empty-elements response.
@suvvvv
suvvvv requested a review from a team as a code owner September 15, 2026 10:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant