Add CoapResponse and CoapRequest #1
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
It looks like the tool you used for formatting the code does not adhere to the same style as I made some more small changes and will be releasing the new version shortly. Thank you for your contribution. |
jasta
added a commit
to jasta/coap-lite
that referenced
this pull request
Mar 10, 2022
get_path is implemented in a way that ignores invalid UTF-8 when forming the result string. This allows an attacker to exploit at least two potential weaknesses with little effort: 1. If coap-rs is used as a proxy to filter paths but forwards requests using the original input bytes, a malicious request could arrive deeper inside a network topology than was intended and potentially cause other issues with less tolerant parsers or handling logic. For example, let's say we wanted to block access to "/foo/*" but allow "/foo", one could encode the path "/foo/<invalid-utf8>" and this would pass our filtering rules but the forwarding target would unexpectedly be asked to handle a request with the extra "<invalid-utf8>" segment on it. 2. Generic logging of incoming request paths would not be reliable making it very difficult to detect a bad actor probing the network looking for weaknesses related to martindisch#1. For example, if we had a generic handler that printed log data using request.get_path() then an attacker could try URLs like "/foo/<invalid-utf8>/test" while the logger would report an innocent looking request for "/foo/test". This would also make forensics after an attack difficult.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Sorry many lines are just automatic formatting on save by
fmt, I hope it's not an issue