Cymmetria / Cymmetria/honeycomb_plugins
simple_http crashes when given URL-encoding in URL
- Dominant language
- HTML
- Stars
- 27
- Forks
- 15
- PR merge metrics
- No merged PRs in 30d
Description
If you try to run simple_http on port 8080 and visit "127.0.0.1:8080/fap=432%424" it's going to crash. This is due to the overridden log_message which thinks the "%424" needs to turn into arguments in the "message % args" part of the log.
The solution can be to .replace("%", "%%") in log_request(), thus escaping the formatting.
(While I'm not versed in Python attacks, in C/C++ this would be a real vulnerability)
Contributor guide
Research direction
Find the simple_http entry point and inspect its overridden log_message and log_request methods. Reproduce the crash with a URL containing encoded percent characters such as 127.0.0.1:8080/fap=432%424, then verify that the request is logged without formatting errors and the server remains running.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100