From 233cce61203686bf4745e056716bee4c4c0a2743 Mon Sep 17 00:00:00 2001
From: Zach Wasserman <zach@fleetdm.com>
Date: Tue, 15 Jun 2021 11:25:52 -0700
Subject: [PATCH] Handle missing server_url in setup (#1093)

Improve error handling to avoid a nil pointer panic in the setup endpoint.
---
 server/service/endpoint_setup.go   | 22 +++++++++++-----------
 server/service/validation_setup.go |  3 ++-
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/server/service/endpoint_setup.go b/server/service/endpoint_setup.go
index a10dedb128..e2fd9fae98 100644
--- a/server/service/endpoint_setup.go
+++ b/server/service/endpoint_setup.go
@@ -10,19 +10,19 @@ import (
 )
 
 type setupRequest struct {
-	Admin           *fleet.UserPayload `json:"admin"`
-	OrgInfo         *fleet.OrgInfo     `json:"org_info"`
-	ServerURL *string            `json:"server_url,omitempty"`
-	EnrollSecret    *string            `json:"osquery_enroll_secret,omitempty"`
+	Admin        *fleet.UserPayload `json:"admin"`
+	OrgInfo      *fleet.OrgInfo     `json:"org_info"`
+	ServerURL    *string            `json:"server_url,omitempty"`
+	EnrollSecret *string            `json:"osquery_enroll_secret,omitempty"`
 }
 
 type setupResponse struct {
-	Admin           *fleet.User    `json:"admin,omitempty"`
-	OrgInfo         *fleet.OrgInfo `json:"org_info,omitempty"`
-	ServerURL *string        `json:"server_url"`
-	EnrollSecret    *string        `json:"osquery_enroll_secret"`
-	Token           *string        `json:"token,omitempty"`
-	Err             error          `json:"error,omitempty"`
+	Admin        *fleet.User    `json:"admin,omitempty"`
+	OrgInfo      *fleet.OrgInfo `json:"org_info,omitempty"`
+	ServerURL    *string        `json:"server_url"`
+	EnrollSecret *string        `json:"osquery_enroll_secret"`
+	Token        *string        `json:"token,omitempty"`
+	Err          error          `json:"error,omitempty"`
 }
 
 func (r setupResponse) error() error { return r.Err }
@@ -85,7 +85,7 @@ func makeSetupEndpoint(svc fleet.Service) endpoint.Endpoint {
 				OrgLogoURL: &config.OrgLogoURL,
 			},
 			ServerURL: &config.ServerURL,
-			Token:           token,
+			Token:     token,
 		}, nil
 	}
 }
diff --git a/server/service/validation_setup.go b/server/service/validation_setup.go
index a3dde6b8e3..05d56ce9a1 100644
--- a/server/service/validation_setup.go
+++ b/server/service/validation_setup.go
@@ -11,7 +11,8 @@ import (
 func (mw validationMiddleware) NewAppConfig(ctx context.Context, payload fleet.AppConfigPayload) (*fleet.AppConfig, error) {
 	invalid := &fleet.InvalidArgumentError{}
 	var serverURLString string
-	if payload.ServerSettings == nil {
+	if payload.ServerSettings == nil || payload.ServerSettings.ServerURL == nil ||
+		*payload.ServerSettings.ServerURL == "" {
 		invalid.Append("server_url", "missing required argument")
 	} else {
 		serverURLString = cleanupURL(*payload.ServerSettings.ServerURL)