Skip to content

IIS: Host header fallback is dead code (r->hostname == NULL can never be true) #3621

Description

@A13501350

Summary

In iis/mymodule.cpp, the Host header fallback when the request URI contains no host is dead code, because r->hostname == NULL can never be true.

r->hostname is assigned from ConvertUTF16ToUTF8(req->CookedUrl.pHost, ...) (line 840). That helper never returns NULL: on NULL/empty input, zero converted bytes, or conversion error it returns the string literal "" (see mymodule.cpp:180-184, :199-202, :226-229); on success it returns a pool-allocated buffer. So after line 840 r->hostname is always non-NULL (an empty string when the URI has no host).

As a result:

  • mymodule.cpp:843 if(r->hostname == NULL) is always false → the fallback to req->Headers.KnownHeaders[HttpHeaderHost] never runs.
  • mymodule.cpp:853 if(r->hostname != NULL) is always true.

Impact

For ordinary HTTP/1.1 requests (GET /path with a Host: header, where the request line carries no host), CookedUrl.pHost is empty, so r->hostname becomes "" instead of the value from the Host header. The intended fallback is silently skipped, leaving r->hostname / r->parsed_uri.hostname empty. Hostname-dependent rules and logging may see an empty host.

Suggested fix

Check for an empty string as well as NULL (keeps the helper's contract intact for the other callers path_info/args):

    r->hostname = ConvertUTF16ToUTF8(req->CookedUrl.pHost, req->CookedUrl.HostLength / sizeof(WCHAR), r->pool);

    if(r->hostname == NULL || r->hostname[0] == '\0')
    {
        if(req->Headers.KnownHeaders[HttpHeaderHost].pRawValue != NULL)
            r->hostname = ZeroTerminate(req->Headers.KnownHeaders[HttpHeaderHost].pRawValue,
                                        req->Headers.KnownHeaders[HttpHeaderHost].RawValueLength, r->pool);
    }

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    2.xRelated to ModSecurity version 2.xPlatform - IIS

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions