Skip to main content

Insecure exceptions - NullPointerException

Need​

Prevention of unexpected system behavior caused by NullPointerException

Context​

  • Usage of PHP for server-side scripting and web development
  • Usage of the User dependency for managing user data and authentication

Description​

Non compliant code​

public function getUser($id) {
    try {
        $user = User::findOrFail($id);
    } catch (\\Exception $e) {
        return null;
    }
}

In the above code, the function getUser is trying to fetch a user with a given id from the database. If the user does not exist, the findOrFail function throws a ModelNotFoundException.

However, the catch block is catching all exceptions (\\Exception $e) which includes NullPointerException and other exceptions that might occur. This is insecure because it can hide underlying issues in your code and cause unexpected behavior.

For instance, if a NullPointerException occurs due to a bug in the findOrFail method (or elsewhere in the try block), this code will catch it and simply return null. As a result, you might not be aware of the issue because the exception is silently swallowed.

Furthermore, this approach can potentially lead to null being returned when the user does exist in the database, but an exception was thrown due to some other issue. This could lead to incorrect behavior in the parts of your application that call this function, as they might interpret the null return value as indicating that the user does not exist.

Steps​

  • Instead of catching all exceptions, catch only the specific exceptions that you expect. In this case, catch the ModelNotFoundException which is thrown when a model is not found.
  • Avoid returning null in the catch block. Instead, handle the exception appropriately. You could log the exception, return a default value, or rethrow the exception.
  • Consider using optional types or null object pattern to avoid NullPointerExceptions.
  • Ensure that the rest of your code can handle the case where getUser returns a non-user object or throws an exception.

Compliant code​

use Illuminate\\Database\\Eloquent\\ModelNotFoundException;

public function getUser($id) {
    try {
        $user = User::findOrFail($id);
        return $user;
    } catch (ModelNotFoundException $e) {
        Log::error("User with id $id not found: " . $e->getMessage());
        throw $e;
    }
}

The updated code now catches only the ModelNotFoundException which is the specific exception thrown when a model is not found in Laravel. This is more secure than catching all exceptions, which could potentially hide other unexpected errors.

In the catch block, instead of returning null, we now log the error and rethrow the exception. This allows the calling code to handle the exception in a way that makes sense in its context. It also provides more information about the error, which can be useful for debugging.

By rethrowing the exception, we ensure that the rest of the code must handle the case where getUser does not return a user object. This forces the calling code to consider this possibility and handle it appropriately, which can help prevent NullPointerExceptions.

Note that this code requires the Log facade to be imported at the top of the file with use Illuminate\\Support\\Facades\\Log;.

References​

Last updated on