OfficeDev / Office-Inspectors-for-Fiddler

Microsoft Office (MAPI, WOPI, and FSSHTTP) inspectors for Fiddler
MIT License
83 stars 55 forks source link

FSSHTTPWOPIInspector: sub responses are not fully read #83

Open germany1234 opened 4 months ago

germany1234 commented 4 months ago

i monitored some fsshttp traffic with fiddler and inspected the result. if subresponses are read, e.g. the query access response, the parsing stops in the middle of the payload. according to the documentation it is parsed in the correct way, but I see the following. there is the 16 bit object stream header end that is parsed at the end. the header type is incorrect (the correct header end type is at the real end of the payload), which is not detected by the parser. all following data is simply ignored by the plugin. which means, the documentation (the MS-FSSHTTPB document) has some issues here or there is some hidden information. Since I'm interested in that protocol and in the fiddler inspector, I would like to have a fix. the official document seems to be wrong. may be there is a way to get more information. I attached an example fsshttpb response which is parsed successfully but not in total and the final 16 bit object stream header end is never reached. the extension is dmp, it is a binary file example.dmp

germany1234 commented 4 months ago

issue.zip here the fiddler trace and here some effect, the header type is wrong (329), which the parser does not detect and simply ignores everything what follows. inspector