Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Robustness against fuzzers #138

Closed
mmaker opened this issue Aug 23, 2014 · 0 comments
Closed

Robustness against fuzzers #138

mmaker opened this issue Aug 23, 2014 · 0 comments

Comments

@mmaker
Copy link

mmaker commented Aug 23, 2014

I tried to use a fuzzer against cyclone, specifically:
pathoc -e -I 200 -t 2 -n 1000 localhost -p 8888 get:/:b@10:ir,@1
which generates some exceptions even on the helloworld httpserver run with:
python demos/helloworld/helloworld.py
(following)

2014-08-23 11:12:28+0200 Unhandled Error
        Traceback (most recent call last):
          File
        "/home/maker/.venvs/cyclone/local/lib/python2.7/site-packages/twisted/python/log.py",
        line 88, in callWithLogger
            return callWithContext({"system": lp}, func, *args, **kw)
          File
        "/home/maker/.venvs/cyclone/local/lib/python2.7/site-packages/twisted/python/log.py",
        line 73, in callWithContext
            return context.call({ILogContext: newCtx}, func, *args, **kw)
          File
        "/home/maker/.venvs/cyclone/local/lib/python2.7/site-packages/twisted/python/context.py",
        line 118, in callWithContext
            return self.currentContext().callWithContext(ctx, func, *args, **kw)
          File
        "/home/maker/.venvs/cyclone/local/lib/python2.7/site-packages/twisted/python/context.py",
        line 81, in callWithContext
            return func(*args,**kw)
        --- <exception caught here> ---
          File
        "/home/maker/.venvs/cyclone/local/lib/python2.7/site-packages/twisted/internet/posixbase.py",
        line 614, in _doReadOrWrite
            why = selectable.doRead()
          File
        "/home/maker/.venvs/cyclone/local/lib/python2.7/site-packages/twisted/internet/tcp.py",
        line 214, in doRead
            return self._dataReceived(data)
          File
        "/home/maker/.venvs/cyclone/local/lib/python2.7/site-packages/twisted/internet/tcp.py",
        line 220, in _dataReceived
            rval = self.protocol.dataReceived(data)
          File
        "/home/maker/.venvs/cyclone/local/lib/python2.7/site-packages/twisted/protocols/basic.py",
        line 571, in dataReceived
            why = self.lineReceived(line)
          File "/home/maker/dev/cyclone/cyclone/httpserver.py", line 96, in
        lineReceived
            self._on_headers(buff)
          File "/home/maker/dev/cyclone/cyclone/httpserver.py", line 158, in
        _on_headers
            headers = httputil.HTTPHeaders.parse(data[eol:])
          File "/home/maker/dev/cyclone/cyclone/httputil.py", line 133, in parse
            h.parse_line(line)
          File "/home/maker/dev/cyclone/cyclone/httputil.py", line 118, in
        parse_line
            name, value = line.split(":", 1)
        exceptions.ValueError: need more than 1 value to unpack

2014-08-23 11:12:28+0200 [http] 404 GET / (127.0.0.1) 0.33ms
2014-08-23 11:12:27+0200 Unhandled Error
        Traceback (most recent call last):
          File
          "/home/maker/.venvs/cyclone/local/lib/python2.7/site-packages/twisted/python/log.py",
          line 88, in callWithLogger
            return callWithContext({"system": lp}, func, *args, **kw)
          File
          "/home/maker/.venvs/cyclone/local/lib/python2.7/site-packages/twisted/python/log.py",
          line 73, in callWithContext
            return context.call({ILogContext: newCtx}, func, *args, **kw)
          File
          "/home/maker/.venvs/cyclone/local/lib/python2.7/site-packages/twisted/python/context.py",
          line 118, in callWithContext
            return self.currentContext().callWithContext(ctx, func, *args, **kw)
          File
          "/home/maker/.venvs/cyclone/local/lib/python2.7/site-packages/twisted/python/context.py",
          line 81, in callWithContext
            return func(*args,**kw)
        --- <exception caught here> ---
          File
          "/home/maker/.venvs/cyclone/local/lib/python2.7/site-packages/twisted/internet/posixbase.py",
          line 614, in _doReadOrWrite
            why = selectable.doRead()
          File
          "/home/maker/.venvs/cyclone/local/lib/python2.7/site-packages/twisted/internet/tcp.py",
          line 214, in doRead
            return self._dataReceived(data)
          File
          "/home/maker/.venvs/cyclone/local/lib/python2.7/site-packages/twisted/internet/tcp.py",
          line 220, in _dataReceived
            rval = self.protocol.dataReceived(data)
          File
          "/home/maker/.venvs/cyclone/local/lib/python2.7/site-packages/twisted/protocols/basic.py",
          line 571, in dataReceived
            why = self.lineReceived(line)
          File "/home/maker/dev/cyclone/cyclone/httpserver.py", line 96, in
          lineReceived
            self._on_headers(buff)
          File "/home/maker/dev/cyclone/cyclone/httpserver.py", line 163, in
          _on_headers
            content_length = int(headers.get("Content-Length", 0))
        exceptions.ValueError: invalid literal for int() with base 10: '\xc3\xbc
        10'
@fiorix fiorix closed this as completed in 187b4b7 Aug 23, 2014
fiorix added a commit that referenced this issue Aug 23, 2014
Fix #138: validate HTTP headers.
hellais pushed a commit to hellais/cyclone that referenced this issue Sep 17, 2014
dpnova added a commit to dpnova/cyclone that referenced this issue Dec 20, 2014
…feature/unittesting

* 'feature/unittesting' of github.com:dpnova/cyclone:
  Ensure the right param data is available on POST and friends.
  Enable cookie interactions (and sessions) in the test client.
  Include new testing and tests packages in the setup.py
  We dont care about coverage on setup.py
  Fix fiorix#138: validate HTTP headers.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant