Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bugfix: prevent TypeError in the bug detectors #586

Merged
merged 1 commit into from
Sep 7, 2023

Conversation

oetr
Copy link
Contributor

@oetr oetr commented Sep 7, 2023

The path-traversal and command-injection bug detectors now don't throw a TypeError upon receiving arguments of the wrong type. Instead, they forward their arguments as-is to their hooked functions that can give meaningful errors.
This also extends guidance and detection support to arguments whose type is Buffer and URL for some functions hooked by the path-traversal bug detector.

@oetr oetr requested a review from a team September 7, 2023 10:33
@oetr oetr force-pushed the FUZZ-800_bugfix_bug_detectors_type_error branch from d5ef3c1 to 57f66dd Compare September 7, 2023 10:35
Copy link
Contributor

@br-lewis br-lewis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. I do wonder if this should apply to URLs as those should also be valid paths to open. Would we be able to detect path traversal on a URL?

@oetr
Copy link
Contributor Author

oetr commented Sep 7, 2023

I do wonder if this should apply to URLs as those should also be valid paths to open. Would we be able to detect path traversal on a URL?

Yes, good point, working on it 😄

@oetr oetr force-pushed the FUZZ-800_bugfix_bug_detectors_type_error branch 3 times, most recently from 83404f6 to bd4cac3 Compare September 7, 2023 12:50
@oetr oetr force-pushed the FUZZ-800_bugfix_bug_detectors_type_error branch from bd4cac3 to bbb9cd7 Compare September 7, 2023 13:09
@oetr oetr enabled auto-merge (rebase) September 7, 2023 15:38
@oetr oetr merged commit 9b7e955 into main Sep 7, 2023
9 checks passed
@oetr oetr deleted the FUZZ-800_bugfix_bug_detectors_type_error branch September 7, 2023 16:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants