dap 0.1.4 → 0.1.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1cc592fe131d06b96989baa2072f92ac1c513465
-  data.tar.gz: 2550d569f533d19d43c05f7a1e778e111f4c96e2
+  metadata.gz: e61f8a06c9943ff97add1aea2ba408fa821d5a79
+  data.tar.gz: 307b216fcf7d20ffed3e744bbe30256acfe97296
 SHA512:
-  metadata.gz: 4a162fc9fb0ae6f9caa0ac9fe1b4c6a3437eccb083d4c6127b334da28906b88584f06ef49ddd3f3a760c844cefe030c90141c6933359e5f44b18b21ba37c1f15
-  data.tar.gz: bbecce1d8ae4a2b1edcbc0e89c282fc04066431954a99520a80a910980dab9b552d4346aaf0016039885a5582d0c7c78c93a092be892a09cbd7f12e93d49532d
+  metadata.gz: 1a17a8311b1d22742203dc4013c95141366f94db7304297cbaf68b29c61e6d5403271075846f3d10392df9a37cd4b947e5d1bb8726a01bc8a3d5286b79cc19a1
+  data.tar.gz: f2bc20c97078b307bf2a469beb1f2652d5a640f1d9e542ec3a1dd040f9bc4049f54379b691b4d16ab510b43721547580dd27b7f3e1c8cb09a40a087e2c6b35f0

data/lib/dap/filter/http.rb

@@ -156,6 +156,7 @@ class FilterDecodeHTTPReply
     transfer_encoding = save["http_raw_headers"]["transfer-encoding"]
     if transfer_encoding && transfer_encoding.include?("chunked")
       offset = 0
+      chunk_num = 1
       body = ''
       while (true)
         # read the chunk size from where we currently are.  The chunk size will
@@ -165,11 +166,16 @@ class FilterDecodeHTTPReply
           chunk_size = chunk_size_str.to_i(16)
           # advance past this chunk marker and its trailing \r\n
           offset += chunk_size_str.size + 2
+          if offset + chunk_size > raw_body.size
+            $stderr.puts "Skipping impossibly large #{chunk_size}-byte ##{chunk_num} chunk, at offset #{offset}/#{raw_body.size}"
+            break
+          end
           # read this chunk, starting from just past the chunk marker and
           # stopping at the supposed end of the chunk
           body << raw_body.slice(offset, chunk_size)
           # advance the offset to past the end of the chunk and its trailing \r\n
           offset += chunk_size + 2
+          chunk_num += 1
         else
           break
         end
@@ -177,7 +183,16 @@ class FilterDecodeHTTPReply
 
       # chunked-encoding allows headers to occur after the chunks, so parse those
       if offset < raw_body.size
-        save.merge!(parse_headers(raw_body.slice(offset, raw_body.size).split(/\r?\n/)))
+        trailing_headers = parse_headers(raw_body.slice(offset, raw_body.size).split(/\r?\n/))
+        save.merge!(trailing_headers) { |header, old, new|
+          if old.kind_of?(String)
+            [old, new].join(',')
+          elsif old.kind_of?(Hash)
+            old.merge(new) { |nheader, nold, nnew|
+              nold + nnew
+            }
+          end
+        }
       end
     end
 

data/lib/dap/version.rb

@@ -1,3 +1,3 @@
 module Dap
-  VERSION = "0.1.4"
+  VERSION = "0.1.5"
 end

data/spec/dap/filter/http_filter_spec.rb

@@ -72,7 +72,7 @@ describe Dap::Filter::FilterDecodeHTTPReply do
       end
     end
 
-    context 'decoding chunked response' do
+    context 'decoding valid chunked responses' do
       let(:body) { "5\r\nabcde\r\n0F\r\nfghijklmnopqrst\r\n06\r\nuvwxyz\r\n0\r\n" }
       let(:decode) { filter.decode("HTTP/1.0 200 OK\r\nTransfer-encoding: chunked\r\n\r\n#{body}\r\nSecret: magic\r\n") }
 
@@ -80,11 +80,41 @@ describe Dap::Filter::FilterDecodeHTTPReply do
         expect(decode['http_body']).to eq(('a'..'z').to_a.join)
       end
 
+      it 'finds normal headers' do
+        expect(decode['http_raw_headers']['transfer-encoding']).to eq(%w(chunked))
+      end
+
       it 'finds trailing headers' do
         expect(decode['http_raw_headers']['secret']).to eq(%w(magic))
       end
     end
 
+    context 'decoding bogus chunked responses' do
+      let(:body) { "5\r\nabcde\r\nFF\r\nfghijklmnopqrst\r\n06\r\n" }
+      let(:decode) { filter.decode("HTTP/1.0 200 OK\r\nTransfer-encoding: chunked\r\n\r\n#{body}") }
+
+      it 'reads the partial body' do
+        expect(decode['http_body']).to eq(('a'..'e').to_a.join)
+      end
+
+      it 'finds normal headers' do
+        expect(decode['http_raw_headers']['transfer-encoding']).to eq(%w(chunked))
+      end
+    end
+
+    context 'decoding truncated, chunked responses' do
+      let(:body) { "5\r\nabcde\r\n0F\r\nfghijklmnopqrst\r\n06\r\n" }
+      let(:decode) { filter.decode("HTTP/1.0 200 OK\r\nTransfer-encoding: chunked\r\n\r\n#{body}") }
+
+      it 'reads the partial body' do
+        expect(decode['http_body']).to eq(('a'..'t').to_a.join)
+      end
+
+      it 'finds normal headers' do
+        expect(decode['http_raw_headers']['transfer-encoding']).to eq(%w(chunked))
+      end
+    end
+
     context 'decoding responses that are missing the "reason phrase", an RFC anomaly' do
       let(:decode) { filter.decode("HTTP/1.1 301\r\nDate: Tue, 28 Mar 2017 20:46:52 GMT\r\nContent-Type: text/html\r\nContent-Length: 177\r\nConnection: close\r\nLocation: http://www.example.com/\r\n\r\nstuff") }
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dap
 version: !ruby/object:Gem::Version
-  version: 0.1.4
+  version: 0.1.5
 platform: ruby
 authors:
 - Rapid7 Research
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-03-30 00:00:00.000000000 Z
+date: 2017-03-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec