Dmytro Shteflyuk created THRIFT-6141:
----------------------------------------
Summary: Ruby HeaderTransport exposes raw ZLIB decompression errors
Key: THRIFT-6141
URL: https://issues.apache.org/jira/browse/THRIFT-6141
Project: Thrift
Issue Type: Bug
Components: Ruby - Library
Reporter: Dmytro Shteflyuk
Assignee: Dmytro Shteflyuk
h3. Problem
Ruby HeaderTransport applies the ZLIB transform without adapting
Zlib::DataError and Zlib::BufError to the established Thrift transport
exception boundary. Invalid or truncated compressed frame payloads therefore
expose implementation-specific exceptions to callers.
h3. Client impact
Applications that handle malformed transport input through
Thrift::TransportException can instead receive an unexpected Zlib exception.
Valid compressed frames and configured decompressed-size limits are unaffected.
h3. Reproduction
Testing on master commit {{a9663bc6661a5dd1d99d629e1f269c1907592a1a}} produces:
{code:ruby}
require "thrift"
require "zlib"
def header_frame(payload)
header = [
Thrift::HeaderSubprotocolID::BINARY,
1,
Thrift::HeaderTransformID::ZLIB,
0
].pack("C*")
frame_size = 10 + header.bytesize + payload.bytesize
[
frame_size,
Thrift::HeaderTransport::HEADER_MAGIC,
0,
0,
header.bytesize / 4
].pack("NnnNn") + header + payload
end
{
"invalid" => "not-zlib",
"truncated" => Zlib::Deflate.deflate("valid payload")[0...-1]
}.each do |name, payload|
transport = Thrift::HeaderTransport.new(
Thrift::MemoryBufferTransport.new(header_frame(payload))
)
begin
transport.read(1)
rescue => error
puts "#{name}: #{error.class}: #{error.message}"
end
end
{code}
{noformat}
invalid: Zlib::DataError: incorrect header check
truncated: Zlib::BufError: buffer error
{noformat}
h3. Expected behavior
Invalid and truncated ZLIB payloads should raise Thrift::TransportException
through the HeaderTransport boundary. Valid compressed frames should continue
to decompress, and oversized decompressed output should continue to raise
TransportException::SIZE_LIMIT.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
