3 ms·
There's nothing inherently wrong with using a regular expression here. The security issue is that there are two different parsers and they interpret invalid in
by js2 3y ago
There's nothing inherently wrong with using a regular expression here.
The security issue is that there are two different parsers and they interpret invalid input differently. This is a parsing differential vulnerability.
This security issue can (and does) occur whenever there is more than one parser implementation.
- theamk 3y agogit treats objects as a generic structure ("list of space-separated name-value pairs, maybe with space continuations, followed by double newline, followed my message") followed by additional rules for individual values. Something very common in older protocols -- see HTTP, deb control files, email, etc... And github code decided to short-circuit the process and combine two steps into one, which introduced weird inter-layer interactions where lines with good name but invalid content would be silently rejected.