What the developer wrote
Authored by Nicolas Dorier
Avoid NRE in ErrorController
What changed, and why it matters
This commit fixes a potential server crash in BTCPay Server's error-handling page. Previously, if a visitor requested a non-HTML error page without specifying a status code, the code could try to use a missing value and throw a NullReferenceException. The change supplies a fallback 500 status code and renames a loop variable to avoid shadowing. It is a small defensive fix rather than a clear-cut exploitable vulnerability.
Treat as a minor hardening/reliability fix. Apply the patch. No urgent security response is indicated by the diff alone; monitor for related crash reports or denial-of-service concerns.
Security signals we found
NullReferenceException crash in request-handling path
Error controller reachable via /errors/{statusCode:int} route
Parameter declared nullable with null default but dereferenced unconditionally
Evidence from the diff
The patch modifies UIErrorController.Handle. The first hunk renames the lambda parameter from v to o so it no longer shadows the outer v variable (cosmetic/no functional change). The second hunk changes return this.StatusCode(statusCode.Value); to return this.StatusCode(statusCode ?? 500);. The original code dereferenced statusCode.Value unconditionally, which would throw a NullReferenceException when statusCode is null (the parameter is declared as int? statusCode = null). The fix provides a default 500 status code. This is a reliability/crash fix; there is no direct evidence in the commit of a security exploit such as information disclosure or code execution.
Changed components
BTCPayServer/Controllers/UIErrorController.csInspect captured patch +2 / −2
diff --git a/BTCPayServer/Controllers/UIErrorController.cs b/BTCPayServer/Controllers/UIErrorController.cs
index 7eb250b..73555a4 100644
--- a/BTCPayServer/Controllers/UIErrorController.cs
+++ b/BTCPayServer/Controllers/UIErrorController.cs
@@ -9,7 +9,7 @@ namespace BTCPayServer.Controllers
[Route("/errors/{statusCode:int}")]
public IActionResult Handle(int? statusCode = null)
{
- if (Request.Headers.TryGetValue("Accept", out var v) && v.Any(v => v.Contains("text/html", StringComparison.OrdinalIgnoreCase)))
+ if (Request.Headers.TryGetValue("Accept", out var v) && v.Any(o => o.Contains("text/html", StringComparison.OrdinalIgnoreCase)))
{
if (statusCode.HasValue)
{
@@ -22,7 +22,7 @@ namespace BTCPayServer.Controllers
}
return View(statusCode);
}
- return this.StatusCode(statusCode.Value);
+ return this.StatusCode(statusCode ?? 500);
}
}
}
Why this scored 34/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.