Mint (Elixir): Fix HTTP Chunked Encoding Parse Vulnerability with PoC

Vulnerability Overview This page displays a Git commit record for an open-source project named ( ) (Commit ). This commit aims to fix a security vulnerability: maliciously constructed HTTP requests (containing malformed chunked encoding) may cause the server to crash or exhibit abnormal behavior. Scope of Impact Affected Components: The HTTP parsing module ( ) and the related chunked encoding processing logic. Specific Symptoms: - Parsing of extensions, quoted values, and whitespace characters preserved via CRLF. - Handling of malformed chunk sizes (including the terminating chunk). - Fixed the function's handling of non-numeric characters. - Fixed the function's handling of malformed extensions. Fix Details 1. Code Changes: - Modified the and functions in to add validation and error handling for malformed inputs (e.g., non-numeric characters, overlong extensions). - Added unit tests ( and ) to cover various edge cases. 2. Test Cases: - Tested various malformed chunk sizes (e.g., , , etc.). - Tested various malformed extensions (e.g., , , etc.). POC Code ```elixir Test case examples test "rejects chunk size longer than 16 digits when stream bytes" do {ok, com} = :gen_tcp.connect("127.0.0.1", 80, [:binary, active: false]) :gen_tcp.send(com, "PUT / HTTP/1.1\r\nHost: example.com\r\nContent-Length: 42\r\n\r\n") {ok, data} = :gen_tcp.recv(com, 42, 5000) assert String.length(data) == 42 end test "accepts malformed extensions" do for extension <- [ "name", "name=value", "name=value extra", "name=value;other", "name=value;other=1", "name=value;other=1;other=2", "name=value;other=1;other=2;other=3", "name=value;other=1;other=2;other=3;other=4", "name=value;other=1;other=2;other=3;other=4;other=5", "name=value;other=1;other=2;other=3;other=4;other=5;other=6", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8;other=9", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8;other=9;other=10", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8;other=9;other=10;other=11", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8;other=9;other=10;other=11;other=12", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8;other=9;other=10;other=11;other=12;other=13", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8;other=9;other=10;other=11;other=12;other=13;other=14", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8;other=9;other=10;other=11;other=12;other=13;other=14;other=15", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8;other=9;other=10;other=11;other=12;other=13;other=14;other=15;other=16", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8;other=9;other=10;other=11;other=12;other=13;other=14;other=15;other=16;other=17", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8;other=9;other=10;other=11;other=12;other=13;other=14;other=15;other=16;other=17;other=18", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8;other=9;other=10;other=11;other=12;other=13;other=14;other=15;other=16;other=17;other=18;other=19", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8;other=9;other=10;other=11;other=12;other=13;other=14;other=15;other=16;other=17;other=18;other=19;other=20", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8;other=9;other=10;other=11;other=12;other=13;other=14;other=15;other=16;other=17;other=18;other=19;other=20;other=21", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8;other=9;other=10;other=11;other=12;other=13;other=14;other=15;other=16;other=17;other=18;other=19;other=20;other=21;other=22", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8;other=9;other=10;other=11;other=12;other=13;other=14;other=15;other=16;other=17;other=18;other=19;other=20;other=21;other=22;other=23", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8;other=9;other=10;other=11;other=12;other=13;other=14;other=15;other=16;other=17;other=18;other=19;other=20;other=21;other=22;other=23;other=24", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8;other=9;other=10;other=11;other=12;other=13;other=14;other=15;other=16;other=17;other=18;other=19;other=20;other=21;other=22;other=23;other=24;other=25", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8;other=9;other=10;other=11;other=12;other=13;other=14;other=15;other=16;other=17;other=18;other=19;other=20;other=21;other=22;other=23;other=24;other=25;other=26", "name=value;other=1;other=2;other=3;other=4;other=5;other=6;other=7;other=8;other=9;other=10;other=11;other=12;other=13;other=14;other=15;other=16;

Goal Reached Thanks to every supporter — we hit 100%!

Mint (Elixir): Fix HTTP Chunked Encoding Parse Vulnerability with PoC

More from this source