[
https://issues.apache.org/jira/browse/GROOVY-11522?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Paul King closed GROOVY-11522.
------------------------------
> Possible Null Pointer Dereference in VariableScopeVisitor.java
> --------------------------------------------------------------
>
> Key: GROOVY-11522
> URL: https://issues.apache.org/jira/browse/GROOVY-11522
> Project: Groovy
> Issue Type: Bug
> Reporter: Zaki
> Assignee: Eric Milles
> Priority: Minor
> Fix For: 4.0.28, 5.0.0-beta-2, 3.0.26
>
>
> h1. Overview
> In file:
> [*VariableScopeVisitor.java*|https://github.com/apache/groovy/blob/master/src/main/java/org/codehaus/groovy/classgen/VariableScopeVisitor.java#L649],
> there is a potential case of null pointer dereference. In method
> {{*visitFieldExpression*}} inside class {{{}*VariableScopeVisitor*{}}}, there
> is a call to {{*checkVariableContextAccess*}} which passes {{*variable*}} as
> a parameter and the {{*variable*}} object comes from
> {{{}*findVariableDeclaration(name)*{}}}, likely locating the variable using
> its name.
>
> {code:java}
> @Override
> public void visitFieldExpression(final FieldExpression expression) {
> String name = expression.getFieldName();
> //TODO: change that to get the correct scope
> Variable variable = findVariableDeclaration(name);
> checkVariableContextAccess(variable, expression);
> }{code}
> Inside *checkVariableContextAccess* method *variable* is immediately
> referenced in the call *variable.isInStaticContext()* without any kind of
> null-checking.
> {code:java}
> private void checkVariableContextAccess(final Variable variable, final
> Expression expression) {
> if (variable.isInStaticContext()) {
> ...
> }
> } {code}
> But *findVariableDeclaration* returns null in cases where *name* equals super
> or this. In these cases *variable.isInStaticContext()* will cause
> {*}NullPointerException{*}.
> {code:java}
> private Variable findVariableDeclaration(final String name) {
> if ("super".equals(name) || "this".equals(name)) return null;
> ...
> } {code}
> Additionally there are two instances
> ([first|https://github.com/apache/groovy/blob/master/src/main/java/org/codehaus/groovy/classgen/VariableScopeVisitor.java#L662],
>
> [second|https://github.com/apache/groovy/blob/master/src/main/java/org/codehaus/groovy/classgen/VariableScopeVisitor.java#L691])
> of invoking {color:#172b4d}{{*findVariableDeclaration*}}{color} in the same
> file where the returned *Variable* object is checked for null value.
> h3. Sponsorship and Support
> This work is done by the security researchers from OpenRefactory and is
> supported by the [Open Source Security Foundation
> (OpenSSF)|https://openssf.org/]: [Project
> Alpha-Omega|https://alpha-omega.dev/]. Alpha-Omega is a project partnering
> with open source software project maintainers to systematically find new,
> as-yet-undiscovered vulnerabilities in open source code - and get them fixed
> - to improve global software supply chain security.
> The bug is found by running the iCR tool by [OpenRefactory,
> Inc.|https://openrefactory.com/] and then manually triaging the results.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
