udo/uce
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden dynamic HTTP and compiler boundaries

Browse Source
This commit is contained in:
root
2026-07-26 11:28:11 +00:00
parent 3d155203bd
commit d0efab7db0
30 changed files with 906 additions and 109 deletions
Download Patch File Download Diff File Expand all files Collapse all files
site/tests/services.uce
+26 -3
View File
@@ -28,14 +28,20 @@ RENDER(Request& context)
u64 sockfd = socket_connect("127.0.0.1", 80);
if(sockfd != 0)
{
u64 closed_handle = socket_connect("127.0.0.1", 80);
bool opaque_handles = sockfd == 1 && closed_handle == 2;
socket_close(closed_handle);
socket_close(closed_handle);
socket_close(999999);
bool closed_write_rejected = !socket_write(closed_handle, "invalid");
bool write_ok = socket_write(sockfd, "GET /tests/index.uce HTTP/1.0\r\nHost: uce.openfu.com\r\n\r\n");
String response = socket_read(sockfd, 4096, 2);
socket_close(sockfd);
bool has_nul = response.find(String("\0", 1)) != String::npos;
mark(
"socket_connect() / socket_write() / socket_read()",
(write_ok && response.find("200 OK") != String::npos && !has_nul) ? "pass" : "fail",
response.substr(0, response.length() > 220 ? 220 : response.length()) + (has_nul ? " [unexpected NUL]" : "")
"socket handles reject invalid and closed indices",
(opaque_handles && closed_write_rejected && write_ok && response.find("200 OK") != String::npos && !has_nul) ? "pass" : "fail",
"handles=" + std::to_string(sockfd) + "/" + std::to_string(closed_handle) + " " + response.substr(0, response.length() > 180 ? 180 : response.length()) + (has_nul ? " [unexpected NUL]" : "")
);
}
else
@@ -130,6 +136,15 @@ RENDER(Request& context)
parsed_underscore.find("'Ada'") != String::npos && parsed_underscore.find("_name") == String::npos ? "pass" : "fail",
parsed_underscore
);
StringMap quoted_params;
quoted_params["name_looking_text"] = "SUBSTITUTED";
String escaped_quote_query = "SELECT 'a\\':name_looking_text'";
String parsed_escaped_quote = placeholder_guard.parse_query_parameters(escaped_quote_query, quoted_params);
mark(
"mysql named placeholders stay opaque after escaped quotes",
parsed_escaped_quote.find(":name_looking_text") != String::npos && parsed_escaped_quote.find("SUBSTITUTED") == String::npos ? "pass" : "fail",
parsed_escaped_quote
);
MySQL unavailable_mysql;
unavailable_mysql.connect("127.0.0.1", "__uce_intentionally_missing__", "not-a-real-password");
mark(
@@ -173,6 +188,14 @@ RENDER(Request& context)
inserted == 2 && updated == 1 && selected == 0 ? "pass" : "fail",
"inserted=" + std::to_string((u64)inserted) + " updated=" + std::to_string((u64)updated) + " selected=" + std::to_string((u64)selected)
);
mysql.query("INSERT INTO uce_affected_rows_test VALUES (1,30)");
u32 duplicate_error_code = mysql._preload_next_error_code;
String duplicate_error = mysql.error();
mark(
"mysql query failures retain server diagnostics",
duplicate_error_code > 1 && duplicate_error != "" && duplicate_error != "Unknown server error" ? "pass" : "fail",
"code=" + std::to_string((u64)duplicate_error_code) + " error=" + duplicate_error
);
}
DValue mysql_perf = request_perf();
String mysql_operations = json_encode(mysql_perf["mysql_operations"]);