Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

simple_http crashes when given URL-encoding in URL #43

Open
Sleeptime17 opened this issue Jun 3, 2018 · 0 comments
Open

simple_http crashes when given URL-encoding in URL #43

Sleeptime17 opened this issue Jun 3, 2018 · 0 comments
Labels
bug Something isn't working good first issue Good for newcomers

Comments

@Sleeptime17
Copy link
Contributor

If you try to run simple_http on port 8080 and visit "127.0.0.1:8080/fap=432%424" it's going to crash. This is due to the overridden log_message which thinks the "%424" needs to turn into arguments in the "message % args" part of the log.

The solution can be to .replace("%", "%%") in log_request(), thus escaping the formatting.
(While I'm not versed in Python attacks, in C/C++ this would be a real vulnerability)

@Sleeptime17 Sleeptime17 added bug Something isn't working good first issue Good for newcomers labels Jun 3, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working good first issue Good for newcomers
Projects
None yet
Development

No branches or pull requests

1 participant