Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Information leakage when sending invalid percentage encoding #3

Closed
NVolcz opened this issue May 29, 2017 · 1 comment
Closed

Information leakage when sending invalid percentage encoding #3

NVolcz opened this issue May 29, 2017 · 1 comment

Comments

@NVolcz
Copy link

NVolcz commented May 29, 2017

The server emits a stacktrace when sending an invalid percentage encoded formData POST request.
id=test&name=%&message=test

400 - Bad Request

Bad Request

Internal error information:
object.Exception@../../.dub/packages/vibe-d-0.7.31/vibe-d/source/vibe/textfilter/urlencode.d(180): invalid percent encoding
----------------
??:? pure @safe bool std.exception.enforce!(Exception, bool).enforce(bool, lazy const(char)[], immutable(char)[], ulong) [0x7cab1d]
??:? pure @safe void vibe.textfilter.urlencode.filterURLDecode!(std.array.Appender!(immutable(char)[]).Appender).filterURLDecode(ref std.array.Appender!(immutable(char)[]).Appender, const(char)[], bool) [0x7dc64c]
??:? pure @safe immutable(char)[] vibe.textfilter.urlencode.formDecode!(immutable(char)).formDecode(immutable(char)[]) [0x897953]
??:? void vibe.inet.webform.parseURLEncodedForm(immutable(char)[], ref vibe.utils.dictionarylist.DictionaryList!(immutable(char)[], true, 16uL, false).DictionaryList) [0x885d6d]
??:? bool vibe.inet.webform.parseFormData(ref vibe.utils.dictionarylist.DictionaryList!(immutable(char)[], true, 16uL, false).DictionaryList, ref vibe.utils.dictionarylist.__T14DictionaryListTS4vibe4inet7webform8FilePartVbi1Vmi0Vbi0Z.DictionaryList, immutable(char)[], vibe.core.stream.InputStream, ulong) [0x8856f0]
??:? bool vibe.http.server.handleRequest(vibe.core.stream.Stream, vibe.core.net.TCPConnection, vibe.http.server.HTTPListenInfo, ref vibe.http.server.HTTPServerSettings, ref bool) [0x80aa67]
??:? void vibe.http.server.handleHTTPConnection(vibe.core.net.TCPConnection, vibe.http.server.HTTPListenInfo) [0x808f4f]
??:? void vibe.http.server.listenHTTPPlain(vibe.http.server.HTTPServerSettings).doListen(vibe.http.server.HTTPListenInfo, bool, bool).__lambda4(vibe.core.net.TCPConnection) [0x80884c]
??:? void vibe.core.drivers.libevent2_tcp.ClientTask.execute() [0x8ac16c]
??:? void vibe.core.core.makeTaskFuncInfo!(void delegate()).makeTaskFuncInfo(ref void delegate()).callDelegate(vibe.core.core.TaskFuncInfo*) [0x75256f]
??:? void vibe.core.core.CoreTask.run() [0x84b56e]
??:? void core.thread.Fiber.run() [0x931ae7]
??:? fiber_entryPoint [0x931862]
??:? [0xffffffff]
@s-ludwig
Copy link
Member

This (HTTPServerOption.errorStackTraces) should probably be disabled in non-debug builds by default. Arguably, any non-500 error could also probably omit the stack trace altogether.

s-ludwig added a commit to vibe-d/vibe.d that referenced this issue May 31, 2017
Enables stack traces only in debug mode by default and does not output stack traces for HTTPServerStatus based exceptions.

See vibe-d/webchat-tutorial#3.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants