2 ms·

I'm guessing they just check what each line starts with. Then they probably split the line on the : to get the value. That would produce the results seen. It s

I'm guessing they just check what each line starts with. Then they probably split the line on the : to get the value. That would produce the results seen. It shows just how careful you have to be when writing code that is Internet-facing, and especially on the scale of AWS where you have half the world's hackers trying to find exploits. I'm not even looking for exploits and I find them every day. For instance, I wanted to read some magazines the other day but they were behind a paywall. Just to see what was behind the wall I checked for a sitemap file. 35MB sitemap.xml contains direct links to the full downloads of every item with no auth needed.

thephyber 5y ago
> It shows just how careful you have to be when writing code that is Internet-facing All code. “Internet facing” is not the only relevant qualification. Any code where user-generated code is parsed should be carefully written, tested, and documented. Edge cases should be identified and described in specs. Non-compliant software should be identified and shamed (or preferably PRed). I know that AWS has already patched some HTTP Smuggling attacks maybe 3 years ago, but I don’t remember if is was the same AWS feature (the previous one might have been CloudFront) and the parsing error might have been a little different.