Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

Incorrect parsing of url-encoded parameters

#113

When retreiving url-encoded values in the querystring that for example contains the value %u0448, the parser throws an error. There is no way to capture and resolve these failures within the rubycode, causing hard failures to for example a front-end nginx.

Proposed solution:
Let all errors through and let the backend handle the problem.

To reproduce:

require 'thin'
require 'thin_parser'

class ThinTest < Test::Unit::TestCase

context "with broken thin parser" do should "not raise an error when parsing a faulty url" do request = Rack::MockRequest.new($app)

  request_headers = "GET /abc/123%x{} HTTP/1.1"
  request_headers.gsub!(/\r/, "")
  request_headers.gsub!(/\n/, "\r\n")
  request_headers << "\r\n";

  x = {'rack.input' => StringIO.new}
  assert_nothing_raised Thin::InvalidRequest do
    Thin::HttpParser.new.execute(x, request_headers, 0)
  end
end
should "raise an error when parsing a url with %u0448 in it" do
  request = Rack::MockRequest.new($app)

  request_headers = "GET /abc/123?a=%u0448 HTTP/1.1"
  request_headers.gsub!(/\r/, "")
  request_headers.gsub!(/\n/, "\r\n")
  request_headers << "\r\n";

  x = {'rack.input' => StringIO.new}
  assert_nothing_raised Thin::InvalidRequest do
    Thin::HttpParser.new.execute(x, request_headers, 0)
  end
end

end end

Reported by Karl Ravn · September 17th, 2009 @ 07:47 AM

State: new
Milestone: Future
Assigned to: macournoyer macournoyer

Activity

  1. macournoyer
    macournoyer

    Not sure I get what you mean. That's the job of the parser to reject bad requests. The Mongrel parser is very strict, but this is what makes the server secure. If you think the parser is rejecting valid HTTP request, point me to the HTTP spec section mentioning this is valid.

    If you want to support invalid HTTP requests you'll have to write a proxy in front of your web server and rewrite the requests.

    September 17th, 2009 @ 08:12 AM

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.