News for hackers. Stuff that matters.

A comment on New differential fuzzing tool reveals novel HTTP request smuggling techniques. Parent comment

Re:New differential fuzzing tool reveals novel HTTP request ... by shakna on Friday November 26, 2021 @03:19AM (#29348351)
> a non-fragile format, e.g. json.

JSON is a terrible format. Especially for streaming data.

Here's a super simple shell script for generating invalid JSON that will blow Python's stack:

    n="$(python3 -c 'import math; import sys; sys.stdout.write(str(math.floor(sys.getrecursionlimit() - 4)))')"

    left="$(yes [ | head -n "$n" | tr -d '\n')"

    echo "$left" | python3 -c 'import json; print(json.loads(input()))'
It is invalid JSON. But you cannot tell if it's invalid until either:

a) You run out of memory.

b) The connection ends.

Because JSON is terrible for streaming data.

[ Parent | on HN ]

There are no comments on this comment yet.