Skip to content

IIS: fix dead Host header fallback (r->hostname == NULL can never be true) - #3622

Open
A13501350 wants to merge 1 commit into
owasp-modsecurity:v2/masterfrom
A13501350:fix/iis-hostname-fallback
Open

A13501350 wants to merge 1 commit into
owasp-modsecurity:v2/masterfrom
A13501350:fix/iis-hostname-fallback

Conversation

@A13501350

Copy link
Copy Markdown

Summary

Fixes the Host header fallback being dead code in the IIS module.

r->hostname is set from ConvertUTF16ToUTF8(req->CookedUrl.pHost, ...) (line 840). That helper never returns NULL — on NULL/empty input, zero converted bytes, or conversion failure it returns the literal "" (mymodule.cpp:180-184, :199-202, :226-229); on success it returns a pool-allocated buffer. So r->hostname is always non-NULL, and if(r->hostname == NULL) at line 843 was never true, silently skipping the Host header fallback.

Now the check also triggers on an empty string, so when the request URI carries no host (ordinary HTTP/1.1 GET /path + Host: header) the host is taken from the Host header as intended.

Fixes

Closes #3621

Changed location

  • iis/mymodule.cpp:843if(r->hostname == NULL)if(r->hostname == NULL || r->hostname[0] == '\0')

The helper's contract is intentionally left unchanged so the other callers (path_info, args) are unaffected.

@coderabbitai

coderabbitai Bot commented Aug 27, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 159d3c3a-9f22-4d8b-8d8d-ffc7208c44de

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@sonarqubecloud

sonarqubecloud Bot commented Aug 27, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
1 Accepted issue

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@airween airween added Platform - IIS 2.x Related to ModSecurity version 2.x labels Sep 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

2.x Related to ModSecurity version 2.x Platform - IIS

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants