-
-
Notifications
You must be signed in to change notification settings - Fork 18
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: malformed header crashes the bg worker
- Now libcurl >= 7.83 is a requirement - Tests are changed to fit new libcurl behavior
- Loading branch information
1 parent
5a66e01
commit c2ba87b
Showing
8 changed files
with
178 additions
and
70 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -45,3 +45,7 @@ location /redirect_me { | |
| location /to_here { | ||
| echo 'I got redirected'; | ||
| } | ||
|
|
||
| location /pathological { | ||
| pathological; | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| { stdenv, postgresql, curl }: | ||
|
|
||
| stdenv.mkDerivation { | ||
| name = "pg_net"; | ||
|
|
||
| buildInputs = [ postgresql curl ]; | ||
|
|
||
| src = ../.; | ||
|
|
||
| installPhase = '' | ||
| mkdir -p $out/bin | ||
| install -D pg_net.so -t $out/lib | ||
| install -D -t $out/share/postgresql/extension sql/*.sql | ||
| install -D -t $out/share/postgresql/extension pg_net.control | ||
| ''; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,112 @@ | ||
| from sqlalchemy import text | ||
|
|
||
| def test_http_header_missing_value(sess): | ||
| """Check that a `MissingValue: ` header is processed correctly""" | ||
|
|
||
| (request_id,) = sess.execute(text( | ||
| """ | ||
| select net.http_get( | ||
| url:='http://localhost:8080/pathological?malformed-header=missing-value' | ||
| ); | ||
| """ | ||
| )).fetchone() | ||
|
|
||
| # Commit so background worker can start | ||
| sess.commit() | ||
|
|
||
| # Collect the response, waiting as needed | ||
| response = sess.execute( | ||
| text( | ||
| """ | ||
| select * from net._http_collect_response(:request_id, async:=false); | ||
| """ | ||
| ), | ||
| {"request_id": request_id}, | ||
| ).fetchone() | ||
| assert response is not None | ||
| assert response[0] == "SUCCESS" | ||
| assert "MissingValue" in response[2] | ||
|
|
||
|
|
||
| def test_http_header_injection(sess): | ||
| """Check that a `HeaderInjection Injected-Header: This header contains an injection` header fails without crashing""" | ||
|
|
||
| (request_id,) = sess.execute(text( | ||
| """ | ||
| select net.http_get( | ||
| url:='http://localhost:8080/pathological?malformed-header=header-injection' | ||
| ); | ||
| """ | ||
| )).fetchone() | ||
|
|
||
| # Commit so background worker can start | ||
| sess.commit() | ||
|
|
||
| # Collect the response, waiting as needed | ||
| response = sess.execute( | ||
| text( | ||
| """ | ||
| select * from net._http_collect_response(:request_id, async:=false); | ||
| """ | ||
| ), | ||
| {"request_id": request_id}, | ||
| ).fetchone() | ||
| assert response is not None | ||
| assert response[0] == "ERROR" | ||
| assert "Weird server reply" in response[1] | ||
|
|
||
|
|
||
| def test_http_header_spaces(sess): | ||
| """Check that a `Spaces In Header Name: This header name contains spaces` header is processed correctly""" | ||
|
|
||
| (request_id,) = sess.execute(text( | ||
| """ | ||
| select net.http_get( | ||
| url:='http://localhost:8080/pathological?malformed-header=spaces-in-header-name' | ||
| ); | ||
| """ | ||
| )).fetchone() | ||
|
|
||
| # Commit so background worker can start | ||
| sess.commit() | ||
|
|
||
| # Collect the response, waiting as needed | ||
| response = sess.execute( | ||
| text( | ||
| """ | ||
| select * from net._http_collect_response(:request_id, async:=false); | ||
| """ | ||
| ), | ||
| {"request_id": request_id}, | ||
| ).fetchone() | ||
| assert response is not None | ||
| assert response[0] == "SUCCESS" | ||
| assert "Spaces In Header Name" in response[2] | ||
|
|
||
|
|
||
| def test_http_header_non_printable_chars(sess): | ||
| """Check that a `NonPrintableChars: NonPrintableChars\\u0001\\u0002` header is processed correctly""" | ||
|
|
||
| (request_id,) = sess.execute(text( | ||
| """ | ||
| select net.http_get( | ||
| url:='http://localhost:8080/pathological?malformed-header=non-printable-chars' | ||
| ); | ||
| """ | ||
| )).fetchone() | ||
|
|
||
| # Commit so background worker can start | ||
| sess.commit() | ||
|
|
||
| # Collect the response, waiting as needed | ||
| response = sess.execute( | ||
| text( | ||
| """ | ||
| select * from net._http_collect_response(:request_id, async:=false); | ||
| """ | ||
| ), | ||
| {"request_id": request_id}, | ||
| ).fetchone() | ||
| assert response is not None | ||
| assert response[0] == "SUCCESS" | ||
| assert r"NonPrintableChars\\u0001\\u0002" in response[2] |