graph/db: fix DecodeHexColor

Ensure that it does a sanity check on the length of its input and also
only call it if the nullable SQL string is not null.

Expand an existing unit tests to cover the DecodeHexColor such that it
would have caught the bug.

graph/db/notifications.go

@@ -473,6 +473,11 @@ func EncodeHexColor(color color.RGBA) string {
 // DecodeHexColor takes a hex color string like "#rrggbb" and returns a
 // color.RGBA.
 func DecodeHexColor(hex string) (color.RGBA, error) {
+	if len(hex) != 7 || hex[0] != '#' {
+		return color.RGBA{}, fmt.Errorf("invalid hex color string: %s",
+			hex)
+	}
+
 	r, err := strconv.ParseUint(hex[1:3], 16, 8)
 	if err != nil {
 		return color.RGBA{}, fmt.Errorf("invalid red component: %w",

graph/db/sql_store.go

@@ -934,9 +934,12 @@ func buildNode(ctx context.Context, db SQLQueries, dbNode *sqlc.Node) (
 	node.LastUpdate = time.Unix(dbNode.LastUpdate.Int64, 0)
 
 	var err error
-	node.Color, err = DecodeHexColor(dbNode.Color.String)
+	if dbNode.Color.Valid {
-	if err != nil {
+		node.Color, err = DecodeHexColor(dbNode.Color.String)
-		return nil, fmt.Errorf("unable to decode color: %w", err)
+		if err != nil {
+			return nil, fmt.Errorf("unable to decode color: %w",
+				err)
+		}
 	}
 
 	// Fetch the node's features.

graph/notifications_test.go

@@ -991,7 +991,9 @@ func TestChannelCloseNotification(t *testing.T) {
 // TestEncodeHexColor tests that the string used to represent a node color is
 // correctly encoded.
 func TestEncodeHexColor(t *testing.T) {
-	var colorTestCases = []struct {
+	t.Parallel()
+
+	var tests = []struct {
 		R       uint8
 		G       uint8
 		B       uint8
@@ -1006,14 +1008,32 @@ func TestEncodeHexColor(t *testing.T) {
 		{1, 2, 3, "#", false},
 	}
 
-	for _, tc := range colorTestCases {
+	for _, test := range tests {
-		encoded := graphdb.EncodeHexColor(
+		t.Run(fmt.Sprintf("R:%d,G:%d,B:%d", test.R, test.G, test.B),
-			color.RGBA{tc.R, tc.G, tc.B, 0},
+			func(t *testing.T) {
+				expColor := color.RGBA{
+					R: test.R,
+					G: test.G,
+					B: test.B,
+				}
+
+				encoded := graphdb.EncodeHexColor(expColor)
+
+				if test.isValid {
+					require.Equal(t, test.encoded, encoded)
+				}
+
+				decoded, err := graphdb.DecodeHexColor(
+					test.encoded,
+				)
+				if test.isValid {
+					require.NoError(t, err)
+					require.Equal(t, expColor, decoded)
+				} else {
+					require.Error(t, err)
+				}
+			},
 		)
-		if (encoded == tc.encoded) != tc.isValid {
-			t.Fatalf("incorrect color encoding, "+
-				"want: %v, got: %v", tc.encoded, encoded)
-		}
 	}
 }