Copilot commented on code in PR #3525:
URL: https://github.com/apache/brpc/pull/3525#discussion_r3950279079
##########
src/brpc/server.cpp:
##########
@@ -2371,6 +2371,42 @@ bool Server::AcceptRequest(Controller* cntl) const {
return true;
}
+bool Server::RejectBuiltinAccess(Controller* cntl,
+ const MethodProperty* mp) const {
+ if (!cntl->is_security_mode() ||
+ (!mp->is_builtin_service && !mp->params.is_tabbed)) {
+ return false;
+ }
Review Comment:
`RejectBuiltinAccess()` dereferences `mp` unconditionally, but `mp` is a raw
pointer in a public method. Even if current call sites always pass a non-null
`MethodProperty*`, this is easy to misuse and would crash the server. Consider
defensively rejecting (or at least validating) null `mp` before accessing its
fields.
This issue also appears on line 2386 of the same file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
