News for hackers. Stuff that matters.
Re:New differential fuzzing tool reveals novel HTTP request ... by richdougherty on Thursday November 25, 2021 @03:14PM (#29344589)
I've implemented a few things from RFCs and I always wish that for each RFC there was a library of test cases to test your implementation.

Does anyone know if there is anything like this for HTTP or associated RFCs?

Eg, for HTTP header parameter, names can have a * to change the character encoding of the parameter value. How many implementations test this? Or tests for decoding of URI paths that contain escaped / characters to make sure they're not confused with the /s that are the path separators.

Re:New differential fuzzing tool reveals novel HTTP request ... by Joker_vD on Thursday November 25, 2021 @03:43PM (#29344804)
Or at least a bunch of examples in the RFC itself. Don't you just love reading a long description of a convoluted data format with literally zero examples of how the full thing looks and what it is supposed to mean? Sadly, leaving the validation undocumented is pretty common across formats/protocol descriptions, and RFCs actually seem to generally be on the "more specific" end of scale, thanks to the ubiquitous use of MUST/SHOULD language. But I've recently wrote a toy ELF parser and it's amazing how many things in its spec are left implicit: e.g. you probably should check that calculating a segment's end (base+size) doesn't overflow and wrap over zero... should you? Maybe you're supposed to support segments that span over the MAX_MEMORY_ADDRESS into the lower memory, who knows? The spec does not say.
Re:New differential fuzzing tool reveals novel HTTP request ... by toomim on Thursday November 25, 2021 @04:03PM (#29344974)
You know, the IETF is an open group, and you can write some examples and submit them as a pull request:

https://httpwg.org/CONTRIBUTING.html

Re:New differential fuzzing tool reveals novel HTTP request ... by aaaaaaaaaaab on Thursday November 25, 2021 @05:08PM (#29345416)
>Eg, for HTTP header parameter, names can have a * to change the character encoding of the parameter value

Where did you read this? HTTP header fields may contain MIME-encoded values using the encoding scheme outlined in rfc2047, but I haven't heard of the asterisk having any special meaning...

Re:New differential fuzzing tool reveals novel HTTP request ... by Joker_vD on Thursday November 25, 2021 @07:42PM (#29346498)
I believe he refers to RFC 8187.