From 748a806adc5a325e63ca6883b2aa9bf15da90513 Mon Sep 17 00:00:00 2001 From: T Date: Thu, 3 Apr 2025 10:00:40 -0600 Subject: Harden Gopher parsing and recover server goroutines Reject oversized or malformed Gopher selectors as parse errors instead of panicking. Keep search requests bounded, and wrap shared server goroutines with panic logging so one bad connection cannot take down the process. --- gopher/request_test.go | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) (limited to 'gopher/request_test.go') diff --git a/gopher/request_test.go b/gopher/request_test.go index 74030c6..3488f39 100644 --- a/gopher/request_test.go +++ b/gopher/request_test.go @@ -2,6 +2,7 @@ package gopher_test import ( "bytes" + "strings" "testing" "github.com/stretchr/testify/assert" @@ -41,3 +42,28 @@ func TestParseRequest(t *testing.T) { }) } } + +func TestParseRequestLimits(t *testing.T) { + t.Run("max selector", func(t *testing.T) { + request, err := gopher.ParseRequest(bytes.NewBufferString(strings.Repeat("a", 255) + "\r\n")) + require.Nil(t, err) + assert.Equal(t, "/"+strings.Repeat("a", 255), request.Path) + }) + + t.Run("selector too long", func(t *testing.T) { + _, err := gopher.ParseRequest(bytes.NewBufferString(strings.Repeat("a", 256) + "\r\n")) + require.NotNil(t, err) + }) + + t.Run("search may extend request line", func(t *testing.T) { + request, err := gopher.ParseRequest(bytes.NewBufferString(strings.Repeat("a", 255) + "\t" + strings.Repeat("b", 255) + "\r\n")) + require.Nil(t, err) + assert.Equal(t, "/"+strings.Repeat("a", 255), request.Path) + assert.Equal(t, strings.Repeat("b", 255), request.RawQuery) + }) + + t.Run("long malformed selector does not panic", func(t *testing.T) { + _, err := gopher.ParseRequest(bytes.NewBufferString(strings.Repeat("a", 1487) + "\r\n")) + require.NotNil(t, err) + }) +} -- cgit v1.3