add null guards to intel collection to catch mismatched ecosystem early

[etsien]

If for whatever reason a submitted CVE doesn't match the language/ecosystem of the target package, we handle it gracefully instead of a misleading HTTP 500 internal server error.

Summary

Add null guards in _add_cve_intel and _add_references to prevent TypeError crashes when clone_and_deps fails and info.intel is never populated.

Problem

When clone_and_deps fails (e.g., due to ecosystem/manifest mismatches), the pipeline skips fetch_intel, leaving model_dict.info.intel = None. The report generation step in output_formatter.py then attempts to iterate over this None value, resulting in an unhandled TypeError: 'NoneType' object is not iterable that surfaces as an HTTP 500 to the caller.

Root Cause

_add_cve_intel (line 136) and _add_references (line 510) both execute for intel_obj in model_dict.info.intel without checking whether info.intel is None. The pipeline's failure path for clone_and_deps does not guarantee that info.intel is populated before reaching the formatter.

Fix

Added early-return null guards at the top of both _add_cve_intel and _add_references:

if model_dict.info.intel is None:
    return

When intel data is unavailable, the report is still generated but omits the intel summary and references sections rather than crashing.

Testing

• Verified across 6 ecosystem-matching CVEs and 15 known ecosystem-mismatched CVEs.
• All runs completed without HTTP 500 errors from this code path.
• Reports for affected CVEs are generated successfully with intel/references sections gracefully omitted.

Attached below is sample output of a ecosystem-mismatched CVE. Previously it would crash the pipeline with HTTP 500 error.
ad2aa354-ee25-4448-8cf6-87b64529576e_CVE-2025-28162_1.json

[vbelouso]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[etsien]

The main thing to check is if this affects the Client in any unintended way.

[zvigrinberg]

@etsien output_formatter.py only applied and being used for/in output config name = cve_file_output.
And this config output type is not being used as the output type mode in user facing environment, what is being used is http output -> cve_http_output, and it doesn't use this

Did you test on file output mode in the configuration? ( to get analysis result as file?)

[etsien]

yes, this only addresses file output mode. I will test with other output modes.

[etsien]

found another area to address, the enable_mlops=True config path runs into a similar issue.
No outstanding intel collection issues with just purely http output.