You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@thrift.apache.org by GitBox <gi...@apache.org> on 2021/03/29 22:41:14 UTC
[GitHub] [thrift] aaronstgeorge-wf opened a new pull request #2366: THRIFT-5383 Remove unnecessary bounds check
aaronstgeorge-wf opened a new pull request #2366:
URL: https://github.com/apache/thrift/pull/2366
<!-- Explain the changes in the pull request below: -->
The added test passes with thrift 0.13.0 and fails on 0.14.0. The source of the error seems to be an unnecessary bounds check when reading JSON string.
<!-- We recommend you review the checklist/tips before submitting a pull request. -->
- [x] Did you create an [Apache Jira](https://issues.apache.org/jira/projects/THRIFT/issues/) ticket? (not required for trivial changes)
- [x] If a ticket exists: Does your pull request title follow the pattern "THRIFT-NNNN: describe my issue"?
- [x] Did you squash your changes to a single commit? (not required, but preferred)
- [x] Did you do your best to avoid breaking changes? If one was needed, did you label the Jira ticket with "Breaking-Change"?
- [x] If your change does not involve any code, include `[skip ci]` anywhere in the commit message to free up build resources.
<!--
The Contributing Guide at:
https://github.com/apache/thrift/blob/master/CONTRIBUTING.md
has more details and tips for committing properly.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [thrift] Jens-G edited a comment on pull request #2366: THRIFT-5383 Fix misplaced capacity check
Posted by GitBox <gi...@apache.org>.
Jens-G edited a comment on pull request #2366:
URL: https://github.com/apache/thrift/pull/2366#issuecomment-810515341
Yeah, ok thow it out. Whatever, We will send the next CVE report to you then.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [thrift] aaronstgeorge-wf edited a comment on pull request #2366: THRIFT-5383 Fix misplaced capacity check
Posted by GitBox <gi...@apache.org>.
aaronstgeorge-wf edited a comment on pull request #2366:
URL: https://github.com/apache/thrift/pull/2366#issuecomment-810519551
I think we we got off on the wrong foot here. Where should that line be? I'm quite happy to move it and write a test that asserts it does what it is supposed to do. From what I know about the JSON protocol, I'm just not sure what it's supposed to do.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [thrift] aaronstgeorge-wf edited a comment on pull request #2366: THRIFT-5383 Fix misplaced capacity check
Posted by GitBox <gi...@apache.org>.
aaronstgeorge-wf edited a comment on pull request #2366:
URL: https://github.com/apache/thrift/pull/2366#issuecomment-810519551
I think we we got off on the wrong foot here. Where should that line be? I'm quite happy to move it and write a test that asserts it does what it is supposed to do. From what I know about the JSON protocol, I'm just not sure what it's supposed to do, or where it's supposed to be. I am not a thrift expert.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [thrift] Jens-G commented on pull request #2366: THRIFT-5383 Fix misplaced capacity check
Posted by GitBox <gi...@apache.org>.
Jens-G commented on pull request #2366:
URL: https://github.com/apache/thrift/pull/2366#issuecomment-810515341
Yeah, ok thow it out. Whatever,.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [thrift] Jens-G edited a comment on pull request #2366: THRIFT-5383 Fix misplaced capacity check
Posted by GitBox <gi...@apache.org>.
Jens-G edited a comment on pull request #2366:
URL: https://github.com/apache/thrift/pull/2366#issuecomment-810432320
+1 perfect solution
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [thrift] aaronstgeorge-wf commented on pull request #2366: THRIFT-5383 Fix misplaced capacity check
Posted by GitBox <gi...@apache.org>.
aaronstgeorge-wf commented on pull request #2366:
URL: https://github.com/apache/thrift/pull/2366#issuecomment-810444361
I'm not sure how we could know the size before reading the string. Because this is in the JSON protocol there is no preceding size packed in the data. All you have is the open quote character and you have to read to the end. This check makes sense for compact, binary, et al because they are serialized with the size of the string contained after, but the serialized JSON representation has no such thing. It's just a quote-delimited string.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [thrift] aaronstgeorge-wf commented on pull request #2366: THRIFT-5383 Fix misplaced capacity check
Posted by GitBox <gi...@apache.org>.
aaronstgeorge-wf commented on pull request #2366:
URL: https://github.com/apache/thrift/pull/2366#issuecomment-810519551
I think we we got off on the wrong foot here. Where should that line be? I'm quite happy to move it and write a test that asserts it does what it is supposed to do. From what I know about the JSON protocol I'm just not sure what it's supposed to do.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [thrift] Jens-G removed a comment on pull request #2366: THRIFT-5383 Fix misplaced capacity check
Posted by GitBox <gi...@apache.org>.
Jens-G removed a comment on pull request #2366:
URL: https://github.com/apache/thrift/pull/2366#issuecomment-810432320
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [thrift] Jens-G commented on pull request #2366: THRIFT-5383 Fix misplaced capacity check
Posted by GitBox <gi...@apache.org>.
Jens-G commented on pull request #2366:
URL: https://github.com/apache/thrift/pull/2366#issuecomment-810432320
-1 the check is NOT unnecessary
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [GitHub] [thrift] aaronstgeorge-wf opened a new pull request
#2366: THRIFT-5383 Remove unnecessary bounds check
Posted by Jens Geyer <je...@hotmail.com>.
-1 the check so NOT unnecessary
Sent from mobile device. You know what that means...
________________________________
From: GitBox <gi...@apache.org>
Sent: Tuesday, March 30, 2021 12:41:14 AM
To: dev@thrift.apache.org <de...@thrift.apache.org>
Subject: [GitHub] [thrift] aaronstgeorge-wf opened a new pull request #2366: THRIFT-5383 Remove unnecessary bounds check
aaronstgeorge-wf opened a new pull request #2366:
URL: https://github.com/apache/thrift/pull/2366
<!-- Explain the changes in the pull request below: -->
The added test passes with thrift 0.13.0 and fails on 0.14.0. The source of the error seems to be an unnecessary bounds check when reading JSON string.
<!-- We recommend you review the checklist/tips before submitting a pull request. -->
- [x] Did you create an [Apache Jira](https://issues.apache.org/jira/projects/THRIFT/issues/) ticket? (not required for trivial changes)
- [x] If a ticket exists: Does your pull request title follow the pattern "THRIFT-NNNN: describe my issue"?
- [x] Did you squash your changes to a single commit? (not required, but preferred)
- [x] Did you do your best to avoid breaking changes? If one was needed, did you label the Jira ticket with "Breaking-Change"?
- [x] If your change does not involve any code, include `[skip ci]` anywhere in the commit message to free up build resources.
<!--
The Contributing Guide at:
https://github.com/apache/thrift/blob/master/CONTRIBUTING.md
has more details and tips for committing properly.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [thrift] aaronstgeorge-wf edited a comment on pull request #2366: THRIFT-5383 Fix misplaced capacity check
Posted by GitBox <gi...@apache.org>.
aaronstgeorge-wf edited a comment on pull request #2366:
URL: https://github.com/apache/thrift/pull/2366#issuecomment-810444361
I'm not sure how we could know the size before reading the string? Because this is in the JSON protocol there is no preceding size packed in the data. All you have is the open quote character and you have to read to the end. This check makes sense for compact, binary, et al because they are serialized with the size of the string contained after, but the serialized JSON representation has no such thing. It's just a quote-delimited string.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [thrift] aaronstgeorge-wf edited a comment on pull request #2366: THRIFT-5383 Fix misplaced capacity check
Posted by GitBox <gi...@apache.org>.
aaronstgeorge-wf edited a comment on pull request #2366:
URL: https://github.com/apache/thrift/pull/2366#issuecomment-810519551
I think we we got off on the wrong foot here. Where should that line be? I'm quite happy to move it and write a test that asserts it does what it is supposed to do. From what I know about the JSON protocol, I'm just not sure what it's supposed to do, or where it's supposed to be.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [thrift] Jens-G closed pull request #2366: THRIFT-5383 Fix misplaced capacity check
Posted by GitBox <gi...@apache.org>.
Jens-G closed pull request #2366:
URL: https://github.com/apache/thrift/pull/2366
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org