3 ms·
The underlying flaw is a parser differential. To detect that generically you'd need a model of both(/all) parsers involved, and to detect when they diverge. Thi
by Retr0id 1y ago
The underlying flaw is a parser differential. To detect that generically you'd need a model of both(/all) parsers involved, and to detect when they diverge. This is non-trivial.
- bkallus 1y agoI have been working on this :) https://github.com/narfindustries/http-garden https://github.com/narfindustries/http-garden
- charcircuit 1y agoYou can have the CDN normalize requests so that it always outputs wellformed requests. This way only one parser deals with an untrusted / ambiguous input.
- deleted 1y ago[deleted]