Comments (2)
Hi @Filly ,
Thank you for opening this issue(!).
I'm testing and I can confirm a weakness in the parser. I'm working on a patch and I'll write the details after the patch was released.
I'm super thankful that you exposed this issue 👍
from facil.io.
Hi @Filly ,
Thank you again for opening this issue(!).
I tried to reproduce the issue on my system and wrote a few javascript tests...
Testing with Safari and Firefox worked fine on my system (I didn't test IE, since I don't have it).
Chrome was the only browser who's Javascript engine could trigger the issue. It seems to be the only client that uses fragmentation when sending messages.
Along the way I discovered that a multi-packet message could, potentially (under certain conditions), throw the parser into an endless loop, exposing a DoS weakness (which had now been fixed).
I patched up the parser and retested on all browsers (Chrome, Safari, Firefox).
I tested with up to 2Mb size messages, which requires setting a larger .max_msg_size
value, i.e.: websocket_upgrade(.max_msg_size = 2097152 /* ... */)
This now works properly on all tested browsers (I didn't test on IE).
Again, thank you for exposing the issue.
I hope you enjoy the framework. Please let me know if you run into any more issues.
Bo.
from facil.io.
Related Issues (20)
- In the example there is facil_run but I don't see this function? HOT 2
- Do you need a main() function if you are just building the shared object library? HOT 1
- fiobj_mustache.c: No folder argument HOT 1
- Passing variables to Mustache does not seem to work HOT 4
- Support for redis UNIX sockets HOT 1
- How to install this framework?
- Potential concurrency issue? Wrong file names on some requests. HOT 4
- crashed on FIOBJ_TYPE_IS(fiobj_null(), FIOBJ_T_NUMBER) HOT 2
- C++ compilation support? HOT 2
- Facil and linux epoll HOT 2
- How to receive an img file? HOT 1
- make breaking on macos m1 HOT 1
- compiling facil to shared library to be called from julia HOT 16
- trying to build native binaries for julia HOT 4
- Get form parameter
- Unlimited threads in facil.io - 0.7.x HTTP / WebSockets Server HOT 1
- SSL/TLS not working for raw-http.c example?
- Zap hasn't mentioned in Readme HOT 1
- Timeout issue when sending large files in the public_folder and over http_sendfile HOT 1
- Help me design / write a generic HTTP routing helper library for the http_s struct. HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from facil.io.