C#: Introduce null checks in the NugetPackageRestorer.

michaelnebel · michaelnebel · commit 547af6c3c957 · 2024-12-10T10:31:12.000+01:00
diff --git a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs
@@ -604,6 +604,10 @@ private bool IsFeedReachable(string feed, int timeoutMilliSeconds, int tryCount,
                 {
                     httpClientHandler.ServerCertificateCustomValidationCallback = (message, cert, chain, _) =>
                     {
+                        if (chain is null || cert is null)
+                        {
+                            return false;
+                        }
                         chain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
                         chain.ChainPolicy.CustomTrustStore.Add(this.dependabotProxy.Certificate);
                         return chain.Build(cert);

Original file line number	Diff line number	Diff line change
`@@ -604,6 +604,10 @@ private bool IsFeedReachable(string feed, int timeoutMilliSeconds, int tryCount,`
`604`	`604`	`{`
`605`	`605`	`httpClientHandler.ServerCertificateCustomValidationCallback = (message, cert, chain, _) =>`
`606`	`606`	`{`
	`607`	`+ if (chain is null \|\| cert is null)`
	`608`	`+ {`
	`609`	`+ return false;`
	`610`	`+ }`
`607`	`611`	`chain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;`
`608`	`612`	`chain.ChainPolicy.CustomTrustStore.Add(this.dependabotProxy.Certificate);`
`609`	`613`	`return chain.Build(cert);`