Comments (4)
Hi @martinvahi.
You are totally right, but echo_server.cc is an example that is not intended to provide production ready code.
However, I'll review our code base and make sure we took this possible attack into consideration.
Thanks.
from elle.
A younger, less experienced, version of me would NOT have noticed that security flaw.
I'm sure that the current version of me is also pretty stupid, but
I can comfort myself with the idea that the situation is kind of
hopeless, as I described at my 2014 blog post titled:
The Future of Security Audits, Episode 0
So, please expect Your example code to be copy-pasted
by novice software developers. Most security flaws that You leave
to Your examples, will be at their code, almost verbatim.
from elle.
I absolutely get your point, and even agree in a sense. However, this is a "get started" example for the coroutine engine, which is already a big concept to assimilate. Making the example DoS resistant would likely triple the size of the code - line length is not the only point of attack. This would drown the user trying to teach himself about Elle in memory managment details, and completely shadow the point of how coroutines work. We are going to respectfully disagree here.
from elle.
Thank You for the answer(s). Obviously it's Your project and
according to my development religion it's then also
Your decision even, if I were a nasty dictator sending my Police force to
"enforce my law", but one thing that You might
consider is to add a small comment to the example. For instance:
//-------------------------------------
// This is a toy example, where the conciseness of the source code
// has higher priority than reliability. In production code the line
elle::Buffer line = socket->read_until("\n");
// allows a Denial of Service attack to be carried out by
// sending a single line of text that has 1TB worth of ASCII characters.
//-------------------------------------
I hope that it helps :-)
from elle.
Related Issues (6)
- Production readiness of athena HOT 1
- Remove unnecessary null pointer checks HOT 3
- Readme: typo HOT 2
- Submodules HOT 3
- failed to build with gcc 7.3.0 HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from elle.