Exploiting URL Parser in Programming Languages (2017) [pdf]

Re:Exploiting URL Parser in Programming Languages (2017) [pdf] by Go0the0gophers on Tuesday September 11, 2018 @08:47AM (#17959193)

Just fuzz every parser you write. And the problem is solved.

[ Parent | on HN ]

Re:Exploiting URL Parser in Programming Languages (2017) [pdf] by whyever on Tuesday September 11, 2018 @09:06AM (#17959351)

I agree with the idea, but I don't think it is enough: A fuzzer does not necessarily find all problems.

[ Parent | on HN ]

Re:Exploiting URL Parser in Programming Languages (2017) [pdf] by Go0the0gophers on Tuesday September 11, 2018 @03:15PM (#17962431)

I wrote several parsers that I fuzzed with tools like AFL or gofuzz. And I promise you that fix lot ugly corner cases.

[ Parent | on HN ]

Re:Exploiting URL Parser in Programming Languages (2017) [pdf] by gsnedders on Tuesday September 11, 2018 @09:28AM (#17959514)

The problem fundamentally is different parsers parsing the same string into different component values. Fuzzing won't solve that.

[ Parent | on HN ]