https://sonarly.com/issue/10350?type=bug
A transient network failure fetching a Google profile picture during OAuth sign-up causes the entire workspace creation transaction to roll back, completely blocking new user registration.
Fix: The original root cause fix (commit `4c001778c2`) addressed the v1.18.1 legacy code path by wrapping `uploadImageFromUrl` in a try/catch within `computeDefaultAvatarUrlLegacy`. The codebase has since been refactored to remove the legacy path and always use `computeDefaultAvatarUrlMigrated`.
However, **the migrated path has the same vulnerability**: `uploadWorkspaceMemberProfilePictureFromUrl` is called without a try/catch at line 483-491 of `user-workspace.service.ts`. While the image *fetch* is internally protected by `fetchImageBufferFromUrl`'s try/catch, the subsequent file *storage* upload (`uploadCorePicture` → `fileStorageService.writeFile`) is not. A storage service failure after a successful image download would still crash the sign-up transaction.
**Change**: Wrapped the `uploadWorkspaceMemberProfilePictureFromUrl` call in `computeDefaultAvatarUrlMigrated` with a try/catch that logs a warning and returns `undefined`, matching the pattern already used for the existing-user branch of the same method (lines 461-478) and the original v1.18.1 fix.
Sonarly Claude Code
569951ba6b