Fix dangling reference outputFile var

[MiguelazoDS]

Description

wazuh/wazuh#34611

2026/02/23 11:14:17 wazuh-manager-modulesd:vulnerability-scanner[70765] eventSendReport.hpp:253 at operator()(): WARNING: EventSendReport - Engine POST failed (exception): std::bad_alloc

Debugging this behavior it was found that the outputFile variable during post operation on UNIX sockets has an invalid reference.

Variable inspection before the change

(gdb) p arg.outputFile
$1 = (const std::string &) @0x7fffdddf19b0: {static npos = 18446744073709551615,
  _M_dataplus = {<std::allocator<char>> = {<std::__new_allocator<char>> = {<No data fields>}, <No data fields>},
    _M_p = 0x7fffdddf1f70 "\220\270F\362\377\177"}, _M_string_length = 140736915774016, {
    _M_local_buf = "@\033\337\335\377\177\000\000P\036\337\335\377\177\000", _M_allocated_capacity = 140736915774272}}

Variable inspection after the change

(gdb) p arg.outputFile 
$1 = {static npos = 18446744073709551615, _M_dataplus = {<std::allocator<char>> = 
  {<std::__new_allocator<char>> = {<No data fields>}, <No data fields>}, 
  _M_p = 0x7fffdafe1c40 ""}, _M_string_length = 0, {_M_local_buf = "\000\000\000\000\000\000\000\000P\037\376\332\377\177\000", _M_allocated_capacity = 0}} (gdb)

Note

We can see the string length value is zero now.

[Copilot]

Pull request overview

Fixes a dangling outputFile reference in the URL request post-request parameters, which was causing invalid string state during UNIX-socket POST operations (observed as std::bad_alloc).

Changes:

• Replace outputFile from const std::string& (defaulting to a temporary) to an owning std::string to prevent dangling references.

Comments suppressed due to low confidence (1)

include/IURLRequest.hpp:222

• This fixes a crash observed in the UNIX-socket POST path, but there doesn’t appear to be a regression test that exercises UNIX-socket requests with default PostRequestParameters/ConfigurationParameters (existing component tests/benchmarks seem focused on HTTP URLs). Adding a focused test that calls the UNIX-socket implementation and verifies it doesn’t crash when outputFile is left empty would help prevent reintroducing this dangling-reference class of issue.

    std::string outputFile {};
};

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.