Merge pull request #47845 from hashicorp/td-lister-describe-with-callback-yield-err

Technical debt: Add and fix semgrep rule `list-iterator-calls-stopped-yield`

Author: ewbankkit

.ci/semgrep/list/callback-pagination.yaml

@@ -0,0 +1,22 @@
+# Copyright IBM Corp. 2014, 2026
+# "SPDX-License-Identifier: MPL-2.0"
+
+rules:
+  - id: list-iterator-calls-stopped-yield
+    message: >-
+      List iterator function uses callback-based paginated finder (lastPage pattern)
+      without ensuring that a stopped yield isn't called on error.
+    languages: [go]
+    severity: WARNING
+    patterns:
+      - pattern: |
+          $ERR := $PAGES_FN($...PARGS, func($PAGE $PTYPE, lastPage bool) bool {
+            $...BODY
+          })
+      - pattern-inside: |
+          return func(yield func($T, error) bool) {
+            $...ALL
+          }
+      - pattern-not-inside: |
+          var stopped bool
+          $...REST

internal/service/apigatewayv2/api_list.go

@@ -95,19 +95,21 @@ type listAPIModel struct {
 
 func listAPIs(ctx context.Context, conn *apigatewayv2.Client, input *apigatewayv2.GetApisInput) iter.Seq2[awstypes.Api, error] {
 	return func(yield func(awstypes.Api, error) bool) {
+		var stopped bool
 		err := getAPIsPages(ctx, conn, input, func(page *apigatewayv2.GetApisOutput, lastPage bool) bool {
 			if page == nil {
 				return !lastPage
 			}
 			for _, item := range page.Items {
 				if !yield(item, nil) {
+					stopped = true
 					return false
 				}
 			}
 			return !lastPage
 		})
-		if err != nil {
-			yield(awstypes.Api{}, fmt.Errorf("listing API Gateway V2 API resources: %w", err))
+		if !stopped && err != nil {
+			yield(inttypes.Zero[awstypes.Api](), fmt.Errorf("listing API Gateway V2 APIs: %w", err))
 		}
 	}
 }

internal/service/apigatewayv2/route_list.go

@@ -115,19 +115,21 @@ type listRouteModel struct {
 
 func listRoutes(ctx context.Context, conn *apigatewayv2.Client, input *apigatewayv2.GetRoutesInput) iter.Seq2[awstypes.Route, error] {
 	return func(yield func(awstypes.Route, error) bool) {
+		var stopped bool
 		err := getRoutesPages(ctx, conn, input, func(page *apigatewayv2.GetRoutesOutput, lastPage bool) bool {
 			if page == nil {
 				return !lastPage
 			}
 			for _, item := range page.Items {
 				if !yield(item, nil) {
+					stopped = true
 					return false
 				}
 			}
 			return !lastPage
 		})
-		if err != nil {
-			yield(awstypes.Route{}, fmt.Errorf("listing API Gateway V2 Route resources: %w", err))
+		if !stopped && err != nil {
+			yield(inttypes.Zero[awstypes.Route](), fmt.Errorf("listing API Gateway V2 Routes: %w", err))
 		}
 	}
 }

internal/service/ec2/find.go

@@ -5365,21 +5365,23 @@ func findTransitGatewayMeteringPolicies(ctx context.Context, conn *ec2.Client, i
 
 func listTransitGatewayMeteringPolicies(ctx context.Context, conn *ec2.Client, input *ec2.DescribeTransitGatewayMeteringPoliciesInput) iter.Seq2[awstypes.TransitGatewayMeteringPolicy, error] {
 	return func(yield func(awstypes.TransitGatewayMeteringPolicy, error) bool) {
+		var stopped bool
 		err := describeTransitGatewayMeteringPoliciesPages(ctx, conn, input, func(page *ec2.DescribeTransitGatewayMeteringPoliciesOutput, lastPage bool) bool {
 			if page == nil {
 				return !lastPage
 			}
 
 			for _, v := range page.TransitGatewayMeteringPolicies {
 				if !yield(v, nil) {
+					stopped = true
 					return false
 				}
 			}
 
 			return !lastPage
 		})
 
-		if err != nil {
+		if !stopped && err != nil {
 			yield(inttypes.Zero[awstypes.TransitGatewayMeteringPolicy](), fmt.Errorf("listing EC2 Transit Gateway Metering Policies: %w", err))
 			return
 		}

internal/service/events/rule_list.go

@@ -100,16 +100,21 @@ type listRuleModel struct {
 
 func listRules(ctx context.Context, conn *eventbridge.Client, input *eventbridge.ListRulesInput) iter.Seq2[awstypes.Rule, error] {
 	return func(yield func(awstypes.Rule, error) bool) {
+		var stopped bool
 		err := listRulesPages(ctx, conn, input, func(page *eventbridge.ListRulesOutput, lastPage bool) bool {
+			if page == nil {
+				return !lastPage
+			}
 			for _, item := range page.Rules {
 				if !yield(item, nil) {
-					return !lastPage
+					stopped = true
+					return false
 				}
 			}
 			return !lastPage
 		})
-		if err != nil {
-			yield(awstypes.Rule{}, fmt.Errorf("listing EventBridge Rule resources: %w", err))
+		if !stopped && err != nil {
+			yield(inttypes.Zero[awstypes.Rule](), fmt.Errorf("listing EventBridge Rules: %w", err))
 			return
 		}
 	}

internal/service/events/target_list.go

@@ -115,22 +115,21 @@ type listTargetModel struct {
 
 func listTargets(ctx context.Context, conn *eventbridge.Client, input *eventbridge.ListTargetsByRuleInput) iter.Seq2[awstypes.Target, error] {
 	return func(yield func(awstypes.Target, error) bool) {
+		var stopped bool
 		err := listTargetsByRulePages(ctx, conn, input, func(page *eventbridge.ListTargetsByRuleOutput, lastPage bool) bool {
 			if page == nil {
 				return !lastPage
 			}
-
 			for _, item := range page.Targets {
 				if !yield(item, nil) {
-					return !lastPage
+					stopped = true
+					return false
 				}
 			}
-
 			return !lastPage
 		})
-
-		if err != nil {
-			yield(awstypes.Target{}, fmt.Errorf("listing EventBridge Target resources: %w", err))
+		if !stopped && err != nil {
+			yield(inttypes.Zero[awstypes.Target](), fmt.Errorf("listing EventBridge Targets: %w", err))
 			return
 		}
 	}