dotnet-security-guard/roslyn-security-guard

Taint Analyzer Null Reference Exception

sjmcallister opened this issue · 6 comments

sjmcallister commented

Analyzer 'RoslynSecurityGuard.Analyzers.Taint.TaintAnalyzer' threw an exception of type 'System.NullReferenceException' with message 'Object reference not set to an instance of an object.'.

This happened right after rebuilding my project.

h3xstream commented

Did you download the extension recently?
There was a bug two weeks ago with class having empty method (native binding)..

h3xstream commented

I will investigate #30 which seems to be the same case.

cizfilip commented

I have same exception in same analyzer:

Analyzer 'RoslynSecurityGuard.Analyzers.Taint.TaintAnalyzer' threw an exception of type 'System.NullReferenceException' with message 'Object reference not set to an instance of an object.'.   
Analyzer 'RoslynSecurityGuard.Analyzers.Taint.TaintAnalyzer' threw the following exception:
'Exception occurred with following context:
Compilation: <Redacted>
SyntaxTree: file.cs
SyntaxNode: public <Redacted> Execute( ... [MethodDeclarationSyntax]@[1638..3317) (39,8)-(66,9)

System.NullReferenceException: Object reference not set to an instance of an object.
   at RoslynSecurityGuard.Analyzers.Taint.TaintAnalyzer.VisitInvocationAndCreation(ExpressionSyntax node, ArgumentListSyntax argList, ExecutionState state)
   at RoslynSecurityGuard.Analyzers.Taint.TaintAnalyzer.VisitMethodInvocation(InvocationExpressionSyntax node, ExecutionState state)
   at RoslynSecurityGuard.Analyzers.Taint.TaintAnalyzer.VisitExpression(ExpressionSyntax expression, ExecutionState state)
   at RoslynSecurityGuard.Analyzers.Taint.TaintAnalyzer.VisitInvocationAndCreation(ExpressionSyntax node, ArgumentListSyntax argList, ExecutionState state)
   at RoslynSecurityGuard.Analyzers.Taint.TaintAnalyzer.VisitObjectCreation(ObjectCreationExpressionSyntax node, ExecutionState state)
   at RoslynSecurityGuard.Analyzers.Taint.TaintAnalyzer.VisitExpression(ExpressionSyntax expression, ExecutionState state)
   at RoslynSecurityGuard.Analyzers.Taint.TaintAnalyzer.VisitStatement(SyntaxNode node, ExecutionState state)
   at RoslynSecurityGuard.Analyzers.Taint.TaintAnalyzer.VisitStatement(SyntaxNode node, ExecutionState state)
   at RoslynSecurityGuard.Analyzers.Taint.TaintAnalyzer.VisitStatement(SyntaxNode node, ExecutionState state)
   at RoslynSecurityGuard.Analyzers.Taint.TaintAnalyzer.VisitMethodDeclaration(MethodDeclarationSyntax node, ExecutionState state)
   at RoslynSecurityGuard.Analyzers.Taint.TaintAnalyzer.VisitMethods(SyntaxNodeAnalysisContext ctx)
   at Microsoft.CodeAnalysis.Diagnostics.AnalyzerExecutor.<>c__DisplayClass42_1.<ExecuteSyntaxNodeAction>b__1()
   at Microsoft.CodeAnalysis.Diagnostics.AnalyzerExecutor.ExecuteAndCatchIfThrows_NoLock(DiagnosticAnalyzer analyzer, Action analyze, Nullable info)
-----
'.

Hope this helps you to identify it

h3xstream commented

You can test this new release:
https://dotnet-security-guard.github.io/releases/RoslynSecurityGuard-2.1.0.vsix

The stacktrace was missing the line number because I build it in Release mode. But I'm pretty sure it is #20.

cizfilip commented

Yes i confirm that error in TaintAnalyzer is gone for my project in new version. Thank you for quick response, great job.

h3xstream commented

Thanks