panic: runtime error: invalid memory address or nil pointer dereference

[z7701858]

httpx version:[INF] Current Version: v1.1.4

Current Behavior:httpx -l target.txt -path "///////../../../../../../etc/passwd"

Expected Behavior:

Steps To Reproduce:

Run 'httpx -l target.txt -path "///////../../../../../../etc/passwd"'
See error

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x58 pc=0x9002d3]

goroutine 14 [running]:
github.com/projectdiscovery/httpx/runner.(*Runner).analyze(_, _, {_, _}, {_, _}, {_, _}, {0xc000eea780, 0x1b}, ...)
        /home/runner/work/httpx/httpx/runner/runner.go:874 +0xe93
github.com/projectdiscovery/httpx/runner.(*Runner).process.func1({0xc000eea780, 0x1b}, {0x9fe1ef, 0x3}, {0xa042ab, 0xa})
        /home/runner/work/httpx/httpx/runner/runner.go:651 +0x125
created by github.com/projectdiscovery/httpx/runner.(*Runner).process
        /home/runner/work/httpx/httpx/runner/runner.go:649 +0x965

Anything else:

[slowmistio]

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x58 pc=0x1501253]

goroutine 291 [running]:
github.com/projectdiscovery/httpx/runner.(*Runner).analyze(_, , {, }, {, }, {, _}, {0xc00079e600, 0xe}, ...)
/home/runner/work/httpx/httpx/runner/runner.go:874 +0xe93
github.com/projectdiscovery/httpx/runner.(*Runner).process.func1({0xc00079e600, 0xe}, {0x16011f1, 0x3}, {0x160717e, 0xa})
/home/runner/work/httpx/httpx/runner/runner.go:651 +0x125
created by github.com/projectdiscovery/httpx/runner.(*Runner).process
/home/runner/work/httpx/httpx/runner/runner.go:649 +0x965

[atastycookie]

➜ httpx -l REDACTED_DOMAIN_LIST.txt --path '////////////////../../../../../../../../etc/passwd' -status-code -mc 200 -ms 'root:'

    __    __  __       _  __
   / /_  / /_/ /_____ | |/ /
  / __ \/ __/ __/ __ \|   /
 / / / / /_/ /_/ /_/ /   |
/_/ /_/\__/\__/ .___/_/|_|
             /_/              v1.1.4

		projectdiscovery.io

Use with caution. You are responsible for your actions.
Developers assume no liability and are not responsible for any misuse or damage.
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x58 pc=0x15bed01]

goroutine 13 [running]:
github.com/projectdiscovery/httpx/runner.(*Runner).analyze(0xc000288500, 0xc0001b3090, 0x16eda67, 0xa, 0xc0001bd5c0, 0x11, 0x16e7a73, 0x3, 0xc0001bd5c0, 0x11, ...)
	/Users/REDACTED/go/pkg/mod/github.com/projectdiscovery/httpx@v1.1.4/runner/runner.go:874 +0x6d41
github.com/projectdiscovery/httpx/runner.(*Runner).process.func1(0xc0000e4fa0, 0xc000288500, 0xc0001b3090, 0xc0001bd5c0, 0x11, 0xc0000fe370, 0xc0000ea480, 0xc0001bd5c0, 0x11, 0x16e7a73, ...)
	/Users/REDACTED/go/pkg/mod/github.com/projectdiscovery/httpx@v1.1.4/runner/runner.go:651 +0xff
created by github.com/projectdiscovery/httpx/runner.(*Runner).process
	/Users/REDACTED/go/pkg/mod/github.com/projectdiscovery/httpx@v1.1.4/runner/runner.go:649 +0x785

[aviadhahami]

Hitting the same problem, can repro on Ubuntu

[oways]

Solved this issue by adding # at the end of the path

Example:

-path "///////../../../../../../../etc/passwd#"

[aviadhahami]

Solved this issue by adding # at the end of the path

Example:

-path "///////../../../../../../../etc/passwd#"

I think not, but dyt there's any impact on the parsers?

[oways]

httpx reading the content of the path that you provide locally first (in your pc) to check for multiple paths and if it is not valid it jumps to the second choice which is fetching for website path, this is why by adding # at the end will be a good workaround as it converts it to invalid local path and it does not effect the actual URI path.

In this case ///////../../../../../../../etc/passwd is a valid system file path for unix based systems

Check the following screenshot:

And for the error yes it is related to parsing as the following value causing the error :*:/ which is part of passwd file:

[ehsandeep]

This is now fixed with latest release - https://github.com/projectdiscovery/httpx/releases/tag/v1.1.5

[aviadhahami]

thx for the quick response @ehsandeep 👍