Skip to content

we don't check if the user supplies the correct number of bytes when specifying content-length #251

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
weissi opened this issue Jun 13, 2020 · 0 comments · Fixed by #255
Closed
Labels
kind/bug Feature doesn't work as expected.
Milestone

Comments

@weissi
Copy link
Contributor

weissi commented Jun 13, 2020

I don't have time right now to fix this but these too tests show the issue:

    func testContentLengthTooLongFails() {
        let url = self.defaultHTTPBinURLPrefix + "/post"
        XCTAssertThrowsError(
            try self.defaultClient.execute(request:
                                            Request(url: url,
                                                    body: .stream(length: 10) { streamWriter in
                                                        streamWriter.write(.byteBuffer(ByteBuffer(string: "1")))
                                                    })).wait()) { error in
            // TODO: content-length wrong error.
        }
        // Quickly try another request and check that it works.
        XCTAssertNoThrow(try self.defaultClient.get(url: self.defaultHTTPBinURLPrefix + "/get").wait())
    }

    // currently gets stuck because of #250 the server just never replies
    func testContentLengthTooShortFails() {
        let url = self.defaultHTTPBinURLPrefix + "/post"
        let tooLong = "XBAD BAD BAD NOT HTTP/1.1\r\n\r\n"
        XCTAssertThrowsError(
            try self.defaultClient.execute(request:
                                            Request(url: url,
                                                    body: .stream(length: 1) { streamWriter in
                                                        streamWriter.write(.byteBuffer(ByteBuffer(string: tooLong)))
                                                    })).wait()) { error in
            // TODO: content-length wrong error.
        }
        // Quickly try another request and check that it works. If we by accident wrote some extra bytes into the
        // stream (and reuse the connection) that could cause problems.
        XCTAssertNoThrow(try self.defaultClient.get(url: self.defaultHTTPBinURLPrefix + "/get").wait())
    }

This probably needs to be a blocker because with a connection pool, this is security relevant. We could end up sending private bytes for one request into the next request by accident.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/bug Feature doesn't work as expected.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant