Skip to content

Conversation

oetr
Copy link
Contributor

@oetr oetr commented Sep 7, 2023

The path-traversal and command-injection bug detectors now don't throw a TypeError upon receiving arguments of the wrong type. Instead, they forward their arguments as-is to their hooked functions that can give meaningful errors.
This also extends guidance and detection support to arguments whose type is Buffer and URL for some functions hooked by the path-traversal bug detector.

@oetr oetr requested a review from a team September 7, 2023 10:33
@oetr oetr force-pushed the FUZZ-800_bugfix_bug_detectors_type_error branch from d5ef3c1 to 57f66dd Compare September 7, 2023 10:35
Copy link
Contributor

@br-lewis br-lewis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. I do wonder if this should apply to URLs as those should also be valid paths to open. Would we be able to detect path traversal on a URL?

@oetr
Copy link
Contributor Author

oetr commented Sep 7, 2023

I do wonder if this should apply to URLs as those should also be valid paths to open. Would we be able to detect path traversal on a URL?

Yes, good point, working on it 😄

@oetr oetr force-pushed the FUZZ-800_bugfix_bug_detectors_type_error branch 3 times, most recently from 83404f6 to bd4cac3 Compare September 7, 2023 12:50
@oetr oetr force-pushed the FUZZ-800_bugfix_bug_detectors_type_error branch from bd4cac3 to bbb9cd7 Compare September 7, 2023 13:09
@oetr oetr enabled auto-merge (rebase) September 7, 2023 15:38
@oetr oetr merged commit 9b7e955 into main Sep 7, 2023
@oetr oetr deleted the FUZZ-800_bugfix_bug_detectors_type_error branch September 7, 2023 16:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants