HelloZeroNet / HelloZeroNet/ZeroNet

Making ZeroNet ready for fuzz testing

Aperta
#885 1 commento 3 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
JavaScript
Stelle
18.8k
Fork
2.3k
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

Some codes in ZeroNet are written in Proof-of-Concept style. They are indeed very clean, but Proof-of-Concept code does not detect malicious input and report errors in a consistent manner. For example, the Web UI returns 500 server errors when it is supposed to return a 403 error. Execution of code does stop, but inconsistent output messages make automatic testing hard.

With the presence of the power of sensationalism combined with the power of trolling, any programming oversight can lead to rumor, biased representation and personal attacks, instead of solution, mitigation and plans. Given the public attention of this project, we should check for "code quality" by introducing more automated tests right now.

There are a few "public doorways" in ZeroNet. The File Server is the public doorway for anyone in the network. The web UI server is the public doorway for ZeroNet gateways. The ZeroFrame APIs are public to all potential codes a ZeroNet site can have.

These "public doorways" do not handle input data well. Sometimes the web UI [returns 500](https://github.com/HelloZeroNet/ZeroNet/issues/777) instead of 200 or 403. The the ZeroFrame Crypto API [raises an uncaught exception](https://github.com/HelloZeroNet/ZeroNet/blob/ee70e2f0224d1bc68565e363aa721eacd90142dc/plugins/CryptMessage/CryptMessagePlugin.py#L95) when the number parameters is unexpected.

Before we can perform future "battle tests" against ZeroNet, at least the error handling process of these "public doorways" should be improved. Error messages reported should be clear and consistent.

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Direzione di ricerca

Start with the web UI behavior described in issue #777 and the ZeroFrame Crypto API entry point in plugins/CryptMessage/CryptMessagePlugin.py. Map the File Server, web UI server, and ZeroFrame APIs to their existing tests and error paths. Done means malformed or unauthorized input produces clear, consistent responses without uncaught exceptions, with automated coverage for the affected public doorways.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
javascript, python
Ambito
api, security, testing-qa
Tipo di issue
Funzionalità
Difficoltà
5/5
Tempo stimato
Più di una settimana
Stato di attività
Ferma
Chiarezza
Da chiarire
Idoneità per principianti
25/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.