Harden integer parsing around headers

Author: josevalim

lib/plug/debugger.ex

@@ -577,6 +577,7 @@ defmodule Plug.Debugger do
 
   def get_mfa(capture) do
     [function_path, arity] = String.split(capture, "/")
+    true = byte_size(arity) <= 3
     {arity, ""} = Integer.parse(arity)
     parts = String.split(function_path, ".")
     {function_str, parts} = List.pop_at(parts, -1)

lib/plug/rewrite_on.ex

@@ -122,6 +122,7 @@ defmodule Plug.RewriteOn do
 
   defp put_port(conn, headers) do
     with [header] <- headers,
+         true <- byte_size(header) <= 5,
          {port, ""} <- Integer.parse(header) do
       %{conn | port: port}
     else

lib/plug/static.ex

@@ -286,6 +286,8 @@ defmodule Plug.Static do
     file_info(size: file_size) = file_info
 
     with %{"bytes" => bytes} <- Plug.Conn.Utils.params(range),
+         # 41 bytes covers two 64 bit byte offsets, enough to address files up to 16 EiB.
+         true <- byte_size(bytes) <= 41,
          {range_start, range_end} <- start_and_end(bytes, file_size) do
       send_range(conn, path, range_start, range_end, file_size, options)
     else

test/plug/debugger_test.exs

@@ -606,6 +606,13 @@ defmodule Plug.DebuggerTest do
              ~r(<a href="https://hexdocs.pm/plug/.*/Plug.Conn.html#send_resp/3" target="_blank">`Plug.Conn.send_resp/3`</a>)
   end
 
+  test "does not parse function references with arities longer than 3 bytes" do
+    assert Plug.Debugger.get_mfa("Plug.Conn.send_resp/333") ==
+             {:ok, Plug.Conn, :send_resp, 333}
+
+    assert Plug.Debugger.get_mfa("Plug.Conn.send_resp/3333") == :error
+  end
+
   test "does not create new atoms" do
     conn =
       conn(:get, "/foo/bar")

test/plug/rewrite_on_test.exs

@@ -84,6 +84,15 @@ defmodule Plug.RewriteOnTest do
     assert conn.port == 3030
   end
 
+  test "does not rewrite port with more than 5 bytes" do
+    conn =
+      conn(:get, "http://example.com/")
+      |> put_req_header("x-forwarded-port", "303030")
+      |> call(:x_forwarded_port)
+
+    assert conn.port == 80
+  end
+
   test "rewrites port with a custom header" do
     conn =
       conn(:get, "http://example.com/")

test/plug/static_test.exs

@@ -422,6 +422,19 @@ defmodule Plug.StaticTest do
       assert get_resp_header(conn, "content-range") == ["bytes 4-4/5"]
     end
 
+    test "returns entire file if range is longer than 41 bytes" do
+      too_large = String.duplicate("1", 42)
+
+      conn =
+        conn(:get, "/public/fixtures/static.txt", [])
+        |> put_req_header("range", "bytes=#{too_large}")
+        |> call()
+
+      assert conn.status == 200
+      assert conn.resp_body == "HELLO"
+      assert get_resp_header(conn, "content-type") == ["text/plain"]
+    end
+
     test "returns entire file if range does not contain either start or end" do
       conn =
         conn(:get, "/public/fixtures/static.txt", [])