-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
HTTP Crawler: don't expect page object for msg #16668
HTTP Crawler: don't expect page object for msg #16668
Conversation
The `crawler_process_page` method in HttpCrawler assumes that the `page` object passed into the method is not nil when formatting the `msg` string for printing to console. Address the assumption with a ternary check leaving the `|| "ERR"` handling for `page.code` itself being nil inside the assignment when page is not nil. Testing: `Error accessing page undefined method '[]' for nil:NilClass` is no longer being thrown when scanning an odd HTTP service.
This actually is a bug in two places in the code as it seems that metasploit-framework/modules/auxiliary/scanner/http/crawler.rb Lines 57 to 65 in 024da20
|
Alright I think the best solution to this would be to add a guard clause. The change you implemented is also valid for checking |
… it for processing pages
Fixed this in d20fa45 |
Release NotesA bug has been fixed in the HTTP crawler module and its associated library whereby the code expected an object to be populated when it may not be. This has been fixed with additional validation. |
The
crawler_process_page
method in HttpCrawler assumes that thepage
object passed into the method is not nil when formatting themsg
string for printing to console.Address the assumption with a ternary check leaving the
|| "ERR"
handling for
page.code
itself being nil inside the assignmentwhen page is not nil.
Testing:
Error accessing page undefined method '[]' for nil:NilClass
isno longer being thrown when scanning an odd HTTP service.