owasp-modsecurity / owasp-modsecurity/ModSecurity
IIS: Host header fallback is dead code (r->hostname == NULL can never be true)
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Summary
In iis/mymodule.cpp, the Host header fallback when the request URI contains no host is dead code, because r->hostname == NULL can never be true.
r->hostname is assigned from ConvertUTF16ToUTF8(req->CookedUrl.pHost, ...) (line 840). That helper never returns NULL: on NULL/empty input, zero converted bytes, or conversion error it returns the string literal "" (see mymodule.cpp:180-184, :199-202, :226-229); on success it returns a pool-allocated buffer. So after line 840 r->hostname is always non-NULL (an empty string when the URI has no host).
As a result:
mymodule.cpp:843if(r->hostname == NULL)is always false → the fallback toreq->Headers.KnownHeaders[HttpHeaderHost]never runs.mymodule.cpp:853if(r->hostname != NULL)is always true.
Impact
For ordinary HTTP/1.1 requests (GET /path with a Host: header, where the request line carries no host), CookedUrl.pHost is empty, so r->hostname becomes "" instead of the value from the Host header. The intended fallback is silently skipped, leaving r->hostname / r->parsed_uri.hostname empty. Hostname-dependent rules and logging may see an empty host.
Suggested fix
Check for an empty string as well as NULL (keeps the helper's contract intact for the other callers path_info/args):
r->hostname = ConvertUTF16ToUTF8(req->CookedUrl.pHost, req->CookedUrl.HostLength / sizeof(WCHAR), r->pool);
if(r->hostname == NULL || r->hostname[0] == '\0')
{
if(req->Headers.KnownHeaders[HttpHeaderHost].pRawValue != NULL)
r->hostname = ZeroTerminate(req->Headers.KnownHeaders[HttpHeaderHost].pRawValue,
req->Headers.KnownHeaders[HttpHeaderHost].RawValueLength, r->pool);
}
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in iis/mymodule.cpp around lines 840-853 and review ConvertUTF16ToUTF8 at lines 180-184, 199-202, and 226-229. Update the fallback condition to handle an empty hostname, then verify that an HTTP/1.1 request with a Host header populates r->hostname and r->parsed_uri.hostname when CookedUrl.pHost is empty.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 82/100