3 ms·
These formats are great for private communication, but become a nice attack surface area if publicly exposed. I was using thrift on an old project and had to ad
by hesdeadjim 7y ago
These formats are great for private communication, but become a nice attack surface area if publicly exposed. I was using thrift on an old project and had to add a sanity check layer to make sure an attacker couldn’t just specify a valid request with a list set to have int.max elements.
- dathinab 7y agoBut any parser needs valid checks of this kind, including the JSON one. A common way to mess with JSON parsers is e.g. to nest a lot arrays and objects. So you needs max nesting depth. There are a bunch of other ways to mess with JSON parsers, too. (In case of MsgPack lists and maps: A parser should only per-allocate memory for given size if it has done proper sanity checks, e.g. compares the given length with the remaining byte length of the message. Also you can simply not preallocate and instead, like in JSON parsers, grow your list on demand and just use the length to know when the list ends). But yes you have to make sure the parser works for your use case.