JQueryKeyValuePairNormalizer is not robust and writes binary derived unicode data into your console
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 290
Description
With a specifically crafted binary upload, which in my case I happened to stumble upon and `Content-Type: application/x-www-form-urlencoded` set in a request, to any endpoint will trigger a 500 and some very ugly console output.
This line will write up to the maximum allowed form key length into the console via the unhandled exception logger. https://github.com/aspnet/AspNetCore/blob/c565386a3ed135560bc2e9017aa54a950b4e35dd/src/Mvc/Mvc.Core/src/ModelBinding/JQueryKeyValuePairNormalizer.cs#L72
Whatever is in there it'll get output, so any ANSI escape sequences are fair game.
Now this all isn't very exploitable as even stdout for twelve-factor apps would just show these sequences as plain text, but it sure is nasty during development.
Removing this ValueProviderFactory allows the request to reach the controller action where we can then return a neat error in the 400 range for whatever our action actually expects.
In essense:
- This ValueProviderFactory is loaded by default in Mvc.
- It's a parser that's easily tripped by fuzzable inputs.
- When tripped its exception message is not neatly trimmed or otherwise processed.
Contributor guide
Assessment
This issue has not been assessed yet.