libphutil: removing bytes from a PhutilRope does not work as intended
Unknown
Vulnerability Details
Mongoose. This is a bug in libphutil, it doesn't seem to affect phabricator because the bytes are always removed one buffer at a time. I imagine this could cause security issues in applications made with libphutil as a framework, if they use PhutilRope directly. This is how it goes:
$rope = new PhutilRope();
$rope->append("aaa");
$rope->append("bbb");
$rope->append("ccc");
$rope->append("rrrrddddddddd");
$rope->removeBytesFromHead(4);
echo $rope->getAsString();
should output "bbcccrrrrddddddddd" but will instead output "ddddddddd".
Actions
View on HackerOneReport Stats
- Report ID: 105657
- State: Closed
- Substate: resolved