C#: Introduce null checks in the NugetPackageRestorer.

github · Dec 9, 2024 · 790c7d0 · 790c7d0
1 parent aea3312
commit 790c7d0
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs
@@ -604,6 +604,10 @@ private bool IsFeedReachable(string feed, int timeoutMilliSeconds, int tryCount,
                 {
                     httpClientHandler.ServerCertificateCustomValidationCallback = (message, cert, chain, _) =>
                     {
+                        if (chain is null || cert is null)
+                        {
+                            return false;
+                        }
                         chain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
                         chain.ChainPolicy.CustomTrustStore.Add(this.dependabotProxy.Certificate);
                         return chain.Build(cert);