|
|
|
|
|
by aeturnum
1822 days ago
|
|
> If they intended something else, then why didn't they write the rules to reflect "else"? If the web server didn't intend to allow a buffer overflow on POST requests, why did it improperly allocate memory? I agree with you that we have a choice: should this be allowed? If not, how do we transition? If yes, do we want to place any limits on it in the future? |
|
Fuzzing may be a good analogy. Fuzzing can be used to test POST request processing when the logic is too complicated to validate via more formal means. We try a large sample of inputs. If they pass, then the test passes, even though we cannot be confident that the code will handle every input string correctly.