Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

http: try parsing Retry-After: as a number first #9718

Closed
wants to merge 1 commit into from

Conversation

bagder
Copy link
Member

@bagder bagder commented Oct 13, 2022

Since the date parser allows YYYYMMDD as a date format (due to it being a bit too generic for parsing this particular header), a large integer number could wrongly match that pattern and cause the parser to generate a wrong value.

No date format accepted for this header starts with a decimal number, so by reversing the check and trying a number first we can deduct that if that works, it was not a date.

Reported-by Trail of Bits

Since the date parser allows YYYYMMDD as a date format (due to it being
a bit too generic for parsing this particular header), a large integer
number could wrongly match that pattern and cause the parser to generate
a wrong value.

No date format accepted for this header starts with a decimal number, so
by reversing the check and trying a number first we can deduct that if
that works, it was not a date.

Reported-by Trail of Bits
@bagder bagder added the HTTP label Oct 13, 2022
@bagder bagder closed this in b46136f Oct 13, 2022
@bagder bagder deleted the bagder/retry-after branch Oct 13, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant