registry: don't panic when store.New returns a nil session

Stores can legitimately return (nil, err) from New (e.g. backend
unavailable). Registry.Get then dereferenced the nil session for
session.name and session.store and crashed the request. Return the
store's error instead.

Signed-off-by: Charlie Tonneslan <cst0520@gmail.com>

Author: c-tonneslan

sessions.go

@@ -137,6 +137,12 @@ func (s *Registry) Get(store Store, name string) (session *Session, err error) {
 		session, err = info.s, info.e
 	} else {
 		session, err = store.New(s.request, name)
+		if session == nil {
+			// Some stores return (nil, err) when initialization fails;
+			// surface the error rather than panicking on session.name.
+			s.sessions[name] = sessionInfo{s: nil, e: err}
+			return nil, err
+		}
 		session.name = name
 		s.sessions[name] = sessionInfo{s: session, e: err}
 	}

sessions_test.go

@@ -214,6 +214,49 @@ func TestCookieStoreMapPanic(t *testing.T) {
 	}
 }
 
+// nilSessionStore returns (nil, err) from New, which the registry used
+// to dereference unconditionally and panic on.
+type nilSessionStore struct{}
+
+func (nilSessionStore) Get(_ *http.Request, _ string) (*Session, error) {
+	return nil, errSentinel
+}
+
+func (nilSessionStore) New(_ *http.Request, _ string) (*Session, error) {
+	return nil, errSentinel
+}
+
+func (nilSessionStore) Save(_ *http.Request, _ http.ResponseWriter, _ *Session) error {
+	return errSentinel
+}
+
+var errSentinel = stringError("store unavailable")
+
+type stringError string
+
+func (e stringError) Error() string { return string(e) }
+
+func TestRegistryGetReturnsErrorWhenStoreReturnsNilSession(t *testing.T) {
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("Registry.Get panicked when store returned nil: %v", r)
+		}
+	}()
+
+	req, err := http.NewRequest("GET", "http://www.example.com", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	reg := GetRegistry(req)
+	sess, err := reg.Get(nilSessionStore{}, "name")
+	if err == nil {
+		t.Fatal("expected error from Registry.Get, got nil")
+	}
+	if sess != nil {
+		t.Fatalf("expected nil session, got %+v", sess)
+	}
+}
+
 func init() {
 	gob.Register(FlashMessage{})
 }