drogonframework / drogon

Drogon: A C++14/17/20 based HTTP web application framework running on Linux/macOS/Unix/Windows
MIT License
11.04k stars 1.06k forks source link

Drogon + invalid json = segfault #2053

Open ranmasao opened 3 weeks ago

ranmasao commented 3 weeks ago

Describe the bug When I send http request using curl with invalid json where I put value without double quotes, even if json processing is inside try-catch block, my application fails.

To Reproduce

  1. Filter starting with next code:

    try {
    auto json = *req->getJsonObject();
    // here could be next code processing json data
    } catch (...) {
    std::cerr << "Invalid JSON" << std::endl;
    }
  2. HttpController using this filter for some endpoint,

  3. Curl request to the corresponding endpoint: curl -s -H "Content-Type: application/json" -X POST --data '{"name": value}' http://localhost:5432/someApi --trace-ascii - (--trace-ascii is to see request body in curl)

  4. Result:

    20240604 13:24:57.709201 UTC 37773 DEBUG [parseJson] * Line 1, Column 10
    Syntax error: value, object or array expected.
    - HttpRequestImpl.cc:57
    Segmentation fault (core dumped)

Expected behavior I really expected the execution to continue inside catch without segfaulting the whole application.

Desktop (please complete the following information):

Additional context I found it accidentally when wrote some API test using curl, and started playing with environment variables substitution.

fantasy-peak commented 3 weeks ago

https://github.com/drogonframework/drogon/blob/0a889e921d23b65fb4694a9e916c4485b0437507/lib/tests/integration_test/client/main.cc#L332

zh7314 commented 1 week ago

Just need to judge in advance,like:

 if (req->getJsonObject() == nullptr)
        {
            throw std::invalid_argument("request json is null");
        }

        auto jsonPtr = req->getJsonObject();