Skip to content

IIS: fix dead Host header fallback (r->hostname == NULL can never be true) - #3622

Open
A13501350 wants to merge 1 commit into
owasp-modsecurity:v2/masterfrom
A13501350:fix/iis-hostname-fallback
Open

IIS: fix dead Host header fallback (r->hostname == NULL can never be true)#3622
A13501350 wants to merge 1 commit into
owasp-modsecurity:v2/masterfrom
A13501350:fix/iis-hostname-fallback

Conversation

@A13501350

Copy link
Copy Markdown

Summary

Fixes the Host header fallback being dead code in the IIS module.

r->hostname is set from ConvertUTF16ToUTF8(req->CookedUrl.pHost, ...) (line 840). That helper never returns NULL — on NULL/empty input, zero converted bytes, or conversion failure it returns the literal "" (mymodule.cpp:180-184, :199-202, :226-229); on success it returns a pool-allocated buffer. So r->hostname is always non-NULL, and if(r->hostname == NULL) at line 843 was never true, silently skipping the Host header fallback.

Now the check also triggers on an empty string, so when the request URI carries no host (ordinary HTTP/1.1 GET /path + Host: header) the host is taken from the Host header as intended.

Fixes

Closes #3621

Changed location

  • iis/mymodule.cpp:843if(r->hostname == NULL)if(r->hostname == NULL || r->hostname[0] == '\0')

The helper's contract is intentionally left unchanged so the other callers (path_info, args) are unaffected.

@coderabbitai

coderabbitai Bot commented Aug 27, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 159d3c3a-9f22-4d8b-8d8d-ffc7208c44de

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@sonarqubecloud

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
E Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant