JSONDecodeError when running Capa worker

[dig-sec]

When running the Capa worker, the task fails with a JSONDecodeError originating from get_input_files().

Error

JSONDecodeError('Expecting value: line 1 column 1 (char 0)')

Traceback

Traceback (most recent call last):
  File "/openrelik/.venv/lib/python3.12/site-packages/celery/app/trace.py", line 479, in trace_task
    R = retval = fun(*args, **kwargs)
  File "/openrelik/.venv/lib/python3.12/site-packages/celery/app/trace.py", line 779, in __protected_call__
    return self.run(*args, **kwargs)
  File "/openrelik/src/tasks.py", line 53, in capa
    input_files = get_input_files(pipe_result, input_files or [])
  File "/openrelik/.venv/lib/python3.12/site-packages/openrelik_worker_common/task_utils.py", line 73, in get_input_files
    result_dict = json.loads(result_string)
  File "/usr/lib/python3.12/json/__init__.py", line 346, in loads
    return _default_decoder.decode(s)
  File "/usr/lib/python3.12/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/usr/lib/python3.12/json/decoder.py", line 355, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None

json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

Root Cause ** :

• Base64 decoding
• json.loads()

If pipe_result is empty or invalid, the worker crashes instead of safely skipping it.

Temporary Fix / Patch

I patched my local OpenRelik install with basic validation and exception handling to prevent the crash.

- if isinstance(pipe_result, str):
+ if isinstance(pipe_result, str) and pipe_result.strip():
     pipe_results.append(pipe_result)

 for pipe_result in pipe_results:
-    result_string = base64.b64decode(pipe_result.encode("utf-8")).decode("utf-8")
-    result_dict = json.loads(result_string)
-    input_files = result_dict.get("output_files", [])
+    try:
+        result_string = base64.b64decode(pipe_result.encode("utf-8")).decode("utf-8")
+        if not result_string.strip():
+            continue
+        result_dict = json.loads(result_string)
+        input_files = result_dict.get("output_files", [])
+    except (json.JSONDecodeError, ValueError, UnicodeDecodeError):
+        continue

[hacktobeer]

We ran into the same yesterday with another worker. Releasing a fix today.

[hacktobeer]

@dig-sec A patched capa worker has been build and released. You can docker pull the latest.
https://github.com/openrelik/openrelik-worker-capa/pkgs/container/openrelik-worker-capa

We will work on a robust fix on Monday.