owasp-modsecurity / owasp-modsecurity/ModSecurity-nginx
Possible dereference of Null
Nobody has claimed this yet.
- Dominant language
- Perl
- Stars
- 1.9k
- Forks
- 312
- PR merge metrics
- No merged PRs in 30d
Description
In result of static analyse of nginx source code (including ngx_http_modsecurity_module) with Svace static analyzer I found error of cathegory "DEREFERENCE OF NULL" (checker finds situations where possible value equal to null can be dereferenced) in ngx_http_modsecurity_module.c
Initialization with possible null returned value here: https://github.com/owasp-modsecurity/ModSecurity-nginx/blob/fd28e6ae3bc9e3e33e5ab177afce5c24af41a6ed/src/ngx_http_modsecurity_module.c#L202
And dereference of location->key field here:
https://github.com/owasp-modsecurity/ModSecurity-nginx/blob/fd28e6ae3bc9e3e33e5ab177afce5c24af41a6ed/src/ngx_http_modsecurity_module.c#L203
Found by Linux Verification Center with SVACE
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src/ngx_http_modsecurity_module.c at the linked lines 202–203 and inspect how the possible null return is handled before location->key is dereferenced. Re-run the relevant Svace analysis or equivalent checks and confirm the reported DEREFERENCE OF NULL warning is resolved without changing valid request handling.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, nginx
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 76/100