stv0g/libwebsockets
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

fix %3d handling in path part and add attack.sh

Browse source 
https://github.com/warmcat/libwebsockets/issues/518

Signed-off-by: Andy Green <andy@warmcat.com>
This commit is contained in:
Andy Green 2016-05-07 08:32:44 +08:00
parent 79b1519b01
commit 179b3ed9ff
2 changed files with 14 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/parsers.c
View file

@ -675,7 +675,9 @@ lws_parse(struct lws *wsi, unsigned char c)
goto swallow;
}
/* uriencoded = in the name part, disallow */
if (c == '=' && enc && !wsi->u.hdr.post_literal_equal)
if (c == '=' && enc &&
ah->frag_index[WSI_TOKEN_HTTP_URI_ARGS] &&
!wsi->u.hdr.post_literal_equal)
c = '_';
/* after the real =, we don't care how many = */

13
test-server/attack.sh
View file

@ -50,6 +50,14 @@ function check {
fi
fi
if [ "$1" == "0" ] ; then
a="`dd if=$LOG bs=1 skip=$LEN 2>/dev/null |grep "get\ \ =" | tr -s ' ' | cut -d' ' -f4-`"
if [ "$a" != "$2" ] ; then
echo "URL path '$a' not $2"
exit 1
fi
fi
if [ "$1" == "1" ] ; then
a="`dd if=$LOG bs=1 skip=$LEN 2>/dev/null |grep URI\ Arg\ 1\: | tr -s ' ' | cut -d' ' -f5-`"
if [ "$a" != "$2" ] ; then
@ -106,9 +114,10 @@ check 1 "key1=value1"
check
echo
echo "---- ? processing (/test?key1%3d2=value1)"
echo "---- ? processing (/t%3dest?key1%3d2=value1)"
rm -f /tmp/lwscap
echo -e "GET /test?key1%3d2=value1 HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
echo -e "GET /t%3dest?key1%3d2=value1 HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
check 0 "/t=est"
check 1 "key1_2=value1"
check