web/admin: handle non-string values in formatUUID to prevent Event Log crash#20804
Merged
BeryJu merged 1 commit intogoauthentik:mainfrom Mar 20, 2026
Merged
Conversation
… crash When event context contains a device with a non-string pk value, formatUUID crashes with TypeError: s.substring is not a function, preventing the entire Event Log page from loading. Add a type guard to coerce non-string values to their string representation instead of crashing. Fixes goauthentik#20803
✅ Deploy Preview for authentik-storybook ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for authentik-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Member
|
@tysoncung While the code change is valid, in which circumstance have you had |
Member
|
For context, this can happen when a login_failed event is created with a failed webauthn validation, which passes |
BeryJu
approved these changes
Mar 20, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #20804 +/- ##
==========================================
- Coverage 93.44% 93.40% -0.05%
==========================================
Files 992 992
Lines 55876 55876
==========================================
- Hits 52213 52189 -24
- Misses 3663 3687 +24
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
authentik-automation bot
pushed a commit
that referenced
this pull request
Mar 20, 2026
…g crash (#20804) fix(web): handle non-string values in formatUUID to prevent Event Log crash When event context contains a device with a non-string pk value, formatUUID crashes with TypeError: s.substring is not a function, preventing the entire Event Log page from loading. Add a type guard to coerce non-string values to their string representation instead of crashing. Fixes #20803
Contributor
|
🍒 Cherry-pick to |
authentik-automation bot
pushed a commit
that referenced
this pull request
Mar 20, 2026
…g crash (#20804) fix(web): handle non-string values in formatUUID to prevent Event Log crash When event context contains a device with a non-string pk value, formatUUID crashes with TypeError: s.substring is not a function, preventing the entire Event Log page from loading. Add a type guard to coerce non-string values to their string representation instead of crashing. Fixes #20803
Contributor
|
🍒 Cherry-pick to |
BeryJu
pushed a commit
that referenced
this pull request
Mar 20, 2026
…g crash (cherry-pick #20804 to version-2026.2) (#21052) web/admin: handle non-string values in formatUUID to prevent Event Log crash (#20804) fix(web): handle non-string values in formatUUID to prevent Event Log crash When event context contains a device with a non-string pk value, formatUUID crashes with TypeError: s.substring is not a function, preventing the entire Event Log page from loading. Add a type guard to coerce non-string values to their string representation instead of crashing. Fixes #20803 Co-authored-by: Tyson Cung <45380903+tysoncung@users.noreply.github.com>
BeryJu
pushed a commit
that referenced
this pull request
Mar 20, 2026
…g crash (cherry-pick #20804 to version-2025.12) (#21051) web/admin: handle non-string values in formatUUID to prevent Event Log crash (#20804) fix(web): handle non-string values in formatUUID to prevent Event Log crash When event context contains a device with a non-string pk value, formatUUID crashes with TypeError: s.substring is not a function, preventing the entire Event Log page from loading. Add a type guard to coerce non-string values to their string representation instead of crashing. Fixes #20803 Co-authored-by: Tyson Cung <45380903+tysoncung@users.noreply.github.com>
kensternberg-authentik
added a commit
that referenced
this pull request
Mar 24, 2026
* main: (41 commits) ci: rotate GH App private key (#21085) internal/web: remove authentication for metrics (#21077) lib/config: explicit some defaults (#21079) internal: remove unix sockets on shutdown (#21081) ci: fix escaping in cherry-pick action (#21082) lib/config: support printing multiple values (#21080) root: fix rust setup (#21078) core: bump types-docker from 7.1.0.20260109 to 7.1.0.20260322 (#21062) policies: remove BufferedPolicyAccessView leftovers (#21057) core: bump axllent/mailpit from v1.29.3 to v1.29.4 in /tests/e2e (#21061) core: bump types-channels from 4.3.0.20250822 to 4.3.0.20260321 (#21063) core: bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.1 (#21059) translate: Updates for project authentik and language fr_FR (#21056) ci: bump taiki-e/install-action from 2.69.2 to 2.69.6 in /.github/actions/setup (#21068) web: bump the storybook group across 1 directory with 5 updates (#21031) web: bump knip from 5.88.0 to 5.88.1 in /web (#21033) web: bump type-fest from 5.4.4 to 5.5.0 in /web (#21032) events: prevent exception when events contains incompatible unicode (#21048) web/admin: handle non-string values in formatUUID to prevent Event Log crash (#20804) events: avoid implicitly setting context from login_failed event (#21045) ...
kensternberg-authentik
added a commit
that referenced
this pull request
Mar 26, 2026
* main: (22 commits) ci: rotate GH App private key (#21085) internal/web: remove authentication for metrics (#21077) lib/config: explicit some defaults (#21079) internal: remove unix sockets on shutdown (#21081) ci: fix escaping in cherry-pick action (#21082) lib/config: support printing multiple values (#21080) root: fix rust setup (#21078) core: bump types-docker from 7.1.0.20260109 to 7.1.0.20260322 (#21062) policies: remove BufferedPolicyAccessView leftovers (#21057) core: bump axllent/mailpit from v1.29.3 to v1.29.4 in /tests/e2e (#21061) core: bump types-channels from 4.3.0.20250822 to 4.3.0.20260321 (#21063) core: bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.1 (#21059) translate: Updates for project authentik and language fr_FR (#21056) ci: bump taiki-e/install-action from 2.69.2 to 2.69.6 in /.github/actions/setup (#21068) web: bump the storybook group across 1 directory with 5 updates (#21031) web: bump knip from 5.88.0 to 5.88.1 in /web (#21033) web: bump type-fest from 5.4.4 to 5.5.0 in /web (#21032) events: prevent exception when events contains incompatible unicode (#21048) web/admin: handle non-string values in formatUUID to prevent Event Log crash (#20804) events: avoid implicitly setting context from login_failed event (#21045) ...
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Fixes #20803
When navigating to Events → Log, the page crashes with:
Why
The
formatUUIDfunction inweb/src/admin/events/utils.tsassumes its argument is always a string. However,event.context.device.pkfrom the API can be a non-string value (e.g., integer or UUID object), sinceEventContextvalues are dynamically typed (EventContextProperty). WhenformatUUIDreceives a non-string, calling.substring()throws aTypeError, crashing the entire Event Log page.How
Added a type guard at the top of
formatUUIDthat checkstypeof hex !== "string"and coerces toString()if needed, rather than crashing. This is a minimal, defensive fix that keeps the rest of the function logic unchanged.Testing
number,undefined, andnullinputs without throwing