Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

P4: Standalone web API can read past its request buffer on a large request body

未关闭 适合新手
  • 哪里不对？
#7,965 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
65/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
cpp
领域
backend, security

调研方向

首先检查 code/network/stand_gui-unix.cpp 第650–656行附近的代码，其中 mg_read 将数据填入 entityBuffer，而 json_loads 对其进行解析。检查如何利用返回的字节数将解析限制在缓冲区范围内，以及应如何处理过大的请求体。完成标准是：长度达到或超过1,024字节的请求体无法导致解析器读取超出缓冲区的内容，且服务器能够安全地处理它。

由索引模型根据 Issue 内容生成。

描述

Low priority: it needs the web panel login, only affects Linux and Mac dedicated servers, and I found it by reading the code, not by running it.

Problem

On a Linux or Mac dedicated server, the web API reads a request body into a 1,024-byte buffer and then parses it as text. When the body is 1,024 bytes or longer, the buffer is filled completely and has no zero byte at the end, so the parser keeps reading past the buffer until it happens to hit one. That can produce garbage input or crash the server.

The code is in code/network/stand_gui-unix.cpp on master (8afa31842), lines 650-656: mg_read fills entityBuffer with up to sizeof(entityBuffer) bytes, then json_loads reads it as a zero-terminated string. The byte count mg_read returns is commented out and unused.

Steps to reproduce (not run; from reading the code)

  1. Start a dedicated server on Linux: fs2_open -standalone with any mod, so the web panel starts on its port (8080 by default).
  2. Send an authenticated PUT /api/1/server or POST /api/1/chat with a body of 1,024 bytes or more.
  3. The JSON parser reads past the end of the 1,024-byte buffer.

Expected vs. actual behavior

Expected: an oversized body is cut off or rejected, and the server keeps running.
Actual (from the code): the parser reads memory past the buffer, which may give a parse error, wrong input, or a crash.

Proposed fixes

  1. Read one byte less so the zero byte from the memset always stays at the end: mg_read(conn, entityBuffer, sizeof(entityBuffer) - 1).
  2. Keep the byte count mg_read returns and parse with json_loadb, which takes a length and never looks for a zero byte.
  3. Read the whole body (up to a sane cap) into an SCP_string and reply with an error when it is too large, so long chat messages are not silently cut off either.
主要语言
C++
星标
488
派生
184
平均合并
1 天 19 小时
30 天内合并 PR
32

环境准备

我们还没有检查这个项目的环境配置文件。先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

scp-fs2open/fs2open.github.com 的其他 Issue

查看 scp-fs2open/fs2open.github.com 的全部 Issue

相似的 Issue

更多 C++ Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。