Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Potential for Null Dereference #31

Open
SpaceTrucker2196 opened this issue Jul 22, 2015 · 1 comment
Open

Potential for Null Dereference #31

SpaceTrucker2196 opened this issue Jul 22, 2015 · 1 comment

Comments

@SpaceTrucker2196
Copy link

Hello,
Our security team has identified potential security concerns in the following files:

HTMLSelector.m:(Line 647)
HTMLNode.m:(Line 167)

Impact:
Most null pointer issues result in general software reliability problems, but if an attacker can intentionally trigger a null pointer dereference, the attacker might be able to use the resulting exception to bypass security logic or to cause the application to reveal debugging information that will be valuable in planning subsequent attacks.

Recommendation:
Implement careful checks before dereferencing objects that might be null. When possible, abstract null checks into wrappers around code that manipulates resources to ensure that they are applied in all cases and to minimize the places where mistakes can occur.

@nolanw
Copy link
Owner

nolanw commented Jul 26, 2015

@SpaceCoder Thanks for the feedback! Unfortunately I'm having some trouble and I would appreciate your help.

Could you share which version or commit of HTMLReader you were using when you identified these issues?

I'm guessing you were looking at HTMLReader 0.7 (as those line numbers in HTMLReader 0.8 seem unlikely to raise any null dereference dander), in which case I'm afraid I haven't spotted the issue. If my guess is right, can you point out which dereferences you find problematic?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants