Skip to main content

Insecure exceptions - NullPointerException

Need​

Prevention of unexpected behavior caused by NullPointer exceptions

Context​

  • Usage of Dart for building cross-platform mobile, web, and desktop applications
  • Usage of Shelf for managing and organizing data in a Node.js application

Description​

Non compliant code​

import 'package:shelf/shelf.dart' as shelf;

void main() {
  var handler = const shelf.Pipeline().addMiddleware(shelf.logRequests()).addHandler(_handleRequest);

  io.serve(handler, 'localhost', 8080);
}

shelf.Response _handleRequest(shelf.Request request) {
  try {
    // Some code here that might throw a NullPointerException
  } catch (e) {
    print("An exception occurred: $e");
    return shelf.Response.ok('Hello, World!\\n');
  }
}

The above Dart code is using the Shelf framework to create a server. The server handles requests using the _handleRequest function.

In this function, there is a try-catch block. The catch block is designed to handle any exceptions that occur in the try block. However, it's not specific about which exceptions it's handling. This means that if a NullPointerException is thrown, it will be caught by this catch block and the server will simply print the exception and continue to operate as if nothing happened.

This is a problem because NullPointerExceptions are often indicative of serious issues in the code, such as trying to access a property or method of a null object. If these exceptions are simply caught and ignored, it can lead to unpredictable behavior in the application, as well as make it much more difficult to debug and fix the underlying issue.

The code is vulnerable because it's not properly handling NullPointerExceptions. Instead of simply catching and ignoring these exceptions, the code should be written in such a way as to prevent them from occurring in the first place. If they do occur, they should be properly logged and the server should respond with an appropriate error message or error code.

Steps​

  • Firstly, avoid catching generic exceptions. Instead, catch specific exceptions that you expect might be thrown in the try block.
  • Secondly, handle the NullPointerException specifically. This can be done by adding another catch block for NullPointerException.
  • Thirdly, in the catch block for NullPointerException, handle the exception in a way that does not disrupt the flow of the program. This could be by returning a default value, logging the error, or rethrowing the exception to be handled at a higher level.
  • Finally, always ensure that all objects are properly initialized before they are used. This can help prevent NullPointerExceptions from occurring in the first place.

Compliant code​

import 'package:shelf/shelf.dart' as shelf;

void main() {
  var handler = const shelf.Pipeline().addMiddleware(shelf.logRequests()).addHandler(_handleRequest);

  io.serve(handler, 'localhost', 8080);
}

shelf.Response _handleRequest(shelf.Request request) {
  try {
    // Some code here that might throw a NullPointerException
  } catch (e) {
    if (e is NullPointerException) {
      print("A null pointer exception occurred: $e");
      // Handle NullPointerException specifically here
      // You can return a default value, log the error, or rethrow the exception
    } else {
      print("An exception occurred: $e");
    }
    return shelf.Response.ok('Hello, World!\\n');
  }
}

The updated code now handles NullPointerException specifically. This is done by adding an if condition inside the catch block to check if the exception is a NullPointerException. If it is, a specific message is printed to the console and the exception can be handled in a specific way. This could be by returning a default value, logging the error, or rethrowing the exception to be handled at a higher level.

The rest of the exceptions are caught by the else block, which prints a generic message to the console. This ensures that only expected exceptions are caught and handled, reducing the risk of unexpected behavior in the system.

Finally, it's important to ensure that all objects are properly initialized before they are used. This can help prevent NullPointerExceptions from occurring in the first place.

References​

Last updated on