Null Pointer Dereference in Actix

Null pointer dereferences in Actix typically occur when handlers unwrap or expect data that may not exist, often through the HttpRequest or web::Query extractors. A common pattern is accessing query parameters without validation:

use actix_web::{web, App, HttpServer, HttpResponse, Responder};

async fn get_user(req: HttpRequest) -> impl Responder {
    let user_id = req.match_info().get("id").unwrap(); // Null pointer if id missing
    let user = find_user_by_id(user_id).await;
    HttpResponse::Ok().json(user)
}

In Actix, match_info().get() returns an Option<&str>. Calling unwrap() without checking will panic if the parameter is missing, causing a denial of service. The same issue appears with JSON body extraction:

use actix_web::{web, App, HttpServer, HttpResponse, Responder};

#[derive(Deserialize)]
struct UserRequest {
    name: String,
    email: String,
}

async fn create_user(json: web::Json<UserRequest>) -> impl Responder {
    let UserRequest { name, email } = *json;
    // If JSON is malformed or missing fields, deserialization fails before here
    // But if struct has Option fields and we unwrap them without checking...
    let user = User::create(name.clone(), email.clone()).await;
    HttpResponse::Ok().json(user)
}

Actix's extractors provide strong typing, but developers often forget that Option fields in request structs can be None. A malicious client can trigger panics by sending requests that exploit these assumptions, leading to application crashes.

Detecting null pointer dereferences in Actix applications requires both static analysis and runtime testing. Static analysis tools like clippy can catch obvious unwrap() calls on Option types:

cargo clippy -- -D clippy::expect-used -D clippy::unwrap-used

This configuration treats unwrap() and expect() as errors, forcing developers to handle Option and Result types properly. However, this only catches explicit calls - indirect dereferences through chained methods can still slip through.

Runtime detection with middleBrick scans Actix applications by sending malformed requests that trigger edge cases:

middlebrick scan https://api.example.com --endpoint /users/{id}

The scanner tests for missing path parameters, malformed JSON, and unexpected request structures. For Actix specifically, middleBrick checks:

• Missing path parameters that cause match_info().get() to return None
• Empty request bodies where JSON deserialization would fail
• Invalid header values that might cause unwrap operations
• Missing authentication tokens that some handlers assume exist

middleBrick's black-box approach tests the actual running Actix application without requiring source code access, making it ideal for detecting runtime null pointer vulnerabilities that static analysis might miss.

Actix provides several patterns for safely handling potentially null values. The most robust approach uses Result types and proper error responses:

use actix_web::{web, App, HttpServer, HttpResponse, Responder, Error};
use actix_web::http::StatusCode;

async fn get_user(req: web::Path<(String,)>) -> Result<impl Responder, Error> {
    let (user_id,) = req.into_inner();
    
    let user = find_user_by_id(&user_id).await.map_err(|_| {
        HttpResponse::build(StatusCode::NOT_FOUND)
            .body(format!("User {} not found", user_id))
    })?;
    
    Ok(HttpResponse::Ok().json(user))
}

This pattern uses web::Path extractor which automatically returns 404 for missing parameters, and map_err to convert service errors into HTTP responses. For query parameters with optional values:

use actix_web::{web, App, HttpServer, HttpResponse, Responder};

async fn search_users(
    query: web::Query<serde_json::Value>
) -> impl Responder {
    let filters = query.get("filters");
    let results = if let Some(filters) = filters {
        search_with_filters(filters).await
    } else {
        search_all().await
    };
    
    HttpResponse::Ok().json(results)
}

For complex validation scenarios, Actix's middleware system can centralize null checks:

use actix_web::{
    dev::ServiceRequest,
    dev::ServiceResponse,
    Error,
    middleware::Mapper,
};

async fn validate_request(mut req: ServiceRequest) -> Result {
    if let Some(user_id) = req.match_info().get("id") {
        if user_id.is_empty() {
            return Err(actix_web::error::ErrorBadRequest("Missing user ID"));
        }
    }
    Ok(req)
}

This middleware runs before handlers, catching null pointer conditions early and returning appropriate HTTP error codes instead of panicking.