maurice/snix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(users/Profpatsch/netencode): ignore earlier record entries

Browse source 
It turns out that the netencode spec requiring to ignore *later*
entries meant that every parser has to do an extra check for each
element, instead of just overriding the key in the hash map.

This leads to a situation where the simple implementation is the wrong
one, which would lead to very subtle problems in parsers (see also the
infamous “json duplicate record entry” problem which has been used for
various exploits in the past).

To be fair, exploits are still possible, but at least a `Map.fromList`
will be the right implementation (provided it folds from the left) now
instead of the wrong one.

Examples of the trivial implementation being now right:

Python:

    > dict([("foo", 1), ("foo", 2)])
    {'foo': 2}

Rust:

    > println!("{:?}", HashMap::from([
      ("foo", 1),
      ("foo", 2)
    ]));
    {"foo": 2}

Haskell:

    > Data.Map.fromList [ ("foo", 1), ("foo", 2) ]
    fromList [("foo",2)]

Change-Id: Ife9593956f4718e5e720f4f348c227e4f3a71e2d
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5108
Tested-by: BuildkiteCI
Reviewed-by: Profpatsch <mail@profpatsch.de>
Reviewed-by: sterni <sternenseemann@systemli.org>
Autosubmit: Profpatsch <mail@profpatsch.de>
This commit is contained in:
Profpatsch 2022-01-29 12:50:19 +01:00
parent 82ba42c439
commit ed68ba6751
2 changed files with 8 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

8
users/Profpatsch/netencode/netencode.rs
View file

@ -405,11 +405,9 @@ pub mod parse {
inner_no_empty_string(tag_g(&inner)),
HashMap::new(),
|mut acc: HashMap<_, _>, Tag { tag, mut val }| {
// ignore duplicated tag names that appear later
// ignore earlier tags with the same name
// according to netencode spec
if !acc.contains_key(tag) {
acc.insert(tag, *val);
}
let _ = acc.insert(tag, *val);
acc
},
),
@ -633,7 +631,7 @@ pub mod parse {
record_t("{25:<1:a|u,<1:b|u,<1:a|i1:-1,}".as_bytes()),
Ok((
"".as_bytes(),
vec![("a".to_owned(), T::Unit), ("b".to_owned(), T::Unit),]
vec![("a".to_owned(), T::I3(-1)), ("b".to_owned(), T::Unit),]
.into_iter()
.collect::<HashMap<_, _>>()
)),