ProcessVolumes in pkg/k8s/deployer.go dereferences vol.Path (a *string) at line 925 without a nil check. If a Volume entry has a source type (secret, configMap, etc.) but no path field set, the nil pointer dereference crashes the process.
validateVolumes does detect a nil Path but returns []string (not error), and none of the callers of ProcessVolumes (k8s deployer, knative deployer) gate on validateVolumes before calling ProcessVolumes. This means a malformed func.yaml with a volume source but no path will crash the deployer.
Affected lines in pkg/k8s/deployer.go:
- Line 925: usedPaths.Has(*vol.Path)
- Line 928: MountPath: *vol.Path
- Line 930: usedPaths.Insert(*vol.Path)
- Line 932: fmt.Errorf(..., *vol.Path)
Fix: add a nil guard for vol.Path before the dereference block.
ProcessVolumes in pkg/k8s/deployer.go dereferences vol.Path (a *string) at line 925 without a nil check. If a Volume entry has a source type (secret, configMap, etc.) but no path field set, the nil pointer dereference crashes the process.
validateVolumes does detect a nil Path but returns []string (not error), and none of the callers of ProcessVolumes (k8s deployer, knative deployer) gate on validateVolumes before calling ProcessVolumes. This means a malformed func.yaml with a volume source but no path will crash the deployer.
Affected lines in pkg/k8s/deployer.go:
Fix: add a nil guard for vol.Path before the dereference block.