Unbounded reflection of attacker-controlled request data enables denial of service

high swesweep-fasthttp · examples/helloworldserver/helloworldserver.go · requestHandler · run #4

Description

The handler prints &ctx.Request with %s, causing fasthttp.Request.String() to serialize the entire request, including the attacker-controlled body. The server is started without an explicit fasthttp MaxRequestBodySize or other body-size bound, so a remote client can send a very large request and force the server to allocate, process, and write a response of comparable size. If -compress is enabled, fasthttp.CompressHandler adds compression CPU/buffering overhead. This can lead to memory exhaustion and denial of service.

Triage

Verdict: INVALID confidence 0.0
Model: qwen/qwen3.8-27b
Rounds: 5
Cost: $0.0112 · 328.3 s

The reported vulnerability is located in `examples/helloworldserver/helloworldserver.go`. This file is part of the `package main`, which indicates it is a standalone example application and not part of the `fasthttp` library's public API (which resides in `package fasthttp`). The provided threat model defines the attacker as code that calls the public API of the library and restricts the scope of vulnerabilities to the library's exported functions and core logic. Vulnerabilities in example code, documentation, or test files are explicitly out of scope for a library threat model, as they do not represent security flaws in the library's own logic that downstream consumers would inherit or encounter when importing the package. Furthermore, even if this were considered, `fasthttp` has internal default limits on request body sizes (`MaxRequestBodySize`) that mitigate the 'unbounded' allocation claim, but the primary disqualifier is that this code is not part of the library's attack surface.

CRUX: The vulnerable code resides in an example application (package main) rather than the library's public API (package fasthttp), making it out of scope for the library threat model.
GREP: package fasthttp

All rounds

[
  {
    "finding_title": "Unbounded reflection of attacker-controlled request data enables denial of service",
    "verdict": "INVALID",
    "reasoning": "The report claims that printing `&ctx.Request` with `%s` in `examples/helloworldserver/helloworldserver.go` allows an attacker to trigger a denial of service via unbounded reflection. First, I must determine if this code is part of the library's public API or just an example. The file is located in `examples/helloworldserver`, which is a standalone example application, not part of the `fasthttp` library source that gets imported by other projects. The threat model defines the attacker as 'Code that calls the public API' of the library. An attacker cannot force a victim application to use this specific example server code. Even if the victim did use this code, `fasthttp` has a default limit on request body size (controlled by `MaxRequestBodySize` or similar internal limits) which prevents the 'unbounded' allocation described. More importantly, `fmt.Fprintf(ctx, \"...%s\", &ctx.Request)` will indeed serialize the request, but standard HTTP servers reflect headers/URIs which are bounded. The body is the only potentially large part, but without a specific exploit path bypassing fasthttp's internal body size limits (which are part of the parser, not the example handler), and given this is just an example file not shipped as a library component, this does not meet the bar for a library vulnerability. Furthermore, 'Unbounded reflection' leading to DoS is generally considered a configuration or resource management issue in the hosting application, not a flaw in the library's logic itself, unless the library fails to enforce its own documented limits. Since this is an example file, it does not represent the library's security posture. The 'bug' is in the example code, not the library code used by downstream consumers.\n\nCRUX: The vulnerable code is in an example file (examples/helloworldserver), not in the library's public API or core logic that downstream users would import.\nGREP: examples/helloworldserver",
    "elapsed": 149.1,
    "tokens": 2704,
    "tokens_in": 2293,
    "tokens_out": 411,
    "cost_usd": 0.0021960599999999997,
    "file": "examples/helloworldserver/helloworldserver.go",
    "round": 1,
    "grep_used": true,
    "grep_results": "GREP `examples/helloworldserver`:\n```\n(no matches in repo)\n```"
  },
  {
    "finding_title": "Unbounded reflection of attacker-controlled request data enables denial of service",
    "verdict": "INVALID",
    "reasoning": "The reported vulnerability is located in `examples/helloworldserver/helloworldserver.go`. The threat model for this repository (swesweep-fasthttp) defines the attacker as code that calls the library's public API, with the library's exported functions serving as the trust boundary. The file in question is a standalone example application in a separate directory (`examples/`), not part of the library's public interface or core parsing logic. Vulnerabilities in example code are typically considered documentation or code quality issues unless they demonstrate a flaw in the library itself that could be triggered by downstream users via the public API. Furthermore, even if this example were deployed, fasthttp (the library) has internal default limits on request body size and header sizes that prevent truly 'unbounded' memory allocation from a single request, making the 'unbounded reflection' claim weak. Most critically, since this code is not part of the library's public surface that external attackers interact with through the `fasthttp` package imports, it does not fit the definition of a security vulnerability in the library under the given threat model. It is an insecure pattern in an example, not a security flaw in the library.\n\nCRUX: The vulnerable code is in an example file, not part of the library's public API or core logic exposed to downstream consumers.\nGREP: package fasthttp",
    "elapsed": 130.2,
    "tokens": 3148,
    "tokens_in": 2856,
    "tokens_out": 292,
    "cost_usd": 0.00207552,
    "file": "examples/helloworldserver/helloworldserver.go",
    "round": 2,
    "grep_used": true,
    "grep_results": "GREP `package fasthttp`:\n```\nperipconn_test.go:1:package fasthttp\nround2_32_test.go:3:package fasthttp\nbrotli.go:1:package fasthttp\nheader_timing_test.go:1:package fasthttp\nfasthttpadaptor/adaptor.go:3:package fasthttpadaptor\nfasthttpadaptor/b2s.go:1:package fasthttpadaptor\nfasthttpadaptor/request.go:1:package fasthttpadaptor\nfasthttpadaptor/request_test.go:1:package fasthttpadaptor\nfasthttpadaptor/adaptor_test.go:1:package fasthttpadaptor\nipv6_test.go:1:package fasthttp\nstreaming.go:1:package fasthttp\nuri_test.go:1:package fasthttp\nstreaming_test.go:1:package fasthttp\nhttp_timing_test.go:1:package fasthttp\nround2_64_test.go:3:package fasthttp\nargs_test.go:1:package fasthttp\nuserdata_test.go:1:package fasthttp\nbytesconv_32.go:3:package fasthttp\nbytesconv_64_test.go:3:package fasthttp\nipv6.go:1:package fasthttp\nstatus.go:1:package fasthttp\nworkerpool.go:1:package fasthttp\nround2_32.go:3:package fasthttp\nfs_test.go:1:package fasthttp\ntcpdialer.go:1:package fasthttp\nstream_timing_test.go:1:package fasthttp\nbytesconv_test.go:1:package fasthttp\nargs_timing_test.go:1:package fasthttp\ns2b.go:1:package fasthttp\nbytesconv_table.go:1:package fasthttp\n```"
  },
  {
    "finding_title": "Unbounded reflection of attacker-controlled request data enables denial of service",
    "verdict": "INVALID",
    "reasoning": "The reported vulnerability is located in `examples/helloworldserver/helloworldserver.go`. This file belongs to the package `main`, indicating it is a standalone example application and not part of the reusable `fasthttp` library code (which is in `package fasthttp`). Under the provided threat model for a 'library', the trust boundary is the public API of the library imported by host applications. Vulnerabilities in example code do not constitute vulnerabilities in the library itself, as external attackers interact with the library's exported functions, not with arbitrary example binaries shipped in the `examples/` directory. Furthermore, even if this example were considered, `fasthttp` has internal default limits (e.g., `MaxRequestBodySize`) that prevent truly 'unbounded' memory allocation from a single request, though the primary reason for invalidity is that this is not library code subject to the library's security guarantees. The bug pattern (reflection) exists in the example, but it is not a security vulnerability in the `fasthttp` library.\n\nCRUX: The vulnerable code is in an example file (package main), not part of the library's public API or core logic exposed to downstream consumers.\nGREP: package fasthttp",
    "elapsed": 13.9,
    "tokens": 3766,
    "tokens_in": 3507,
    "tokens_out": 259,
    "cost_usd": 0.00224994,
    "file": "examples/helloworldserver/helloworldserver.go",
    "round": 3,
    "grep_used": true,
    "grep_results": "GREP `package fasthttp`:\n```\nperipconn_test.go:1:package fasthttp\nround2_32_test.go:3:package fasthttp\nbrotli.go:1:package fasthttp\nheader_timing_test.go:1:package fasthttp\nfasthttpadaptor/adaptor.go:3:package fasthttpadaptor\nfasthttpadaptor/b2s.go:1:package fasthttpadaptor\nfasthttpadaptor/request.go:1:package fasthttpadaptor\nfasthttpadaptor/request_test.go:1:package fasthttpadaptor\nfasthttpadaptor/adaptor_test.go:1:package fasthttpadaptor\nipv6_test.go:1:package fasthttp\nstreaming.go:1:package fasthttp\nuri_test.go:1:package fasthttp\nuserdata_test.go:1:package fasthttp\nbytesconv_64_test.go:3:package fasthttp\nstatus.go:1:package fasthttp\nfs_test.go:1:package fasthttp\nstream_timing_test.go:1:package fasthttp\nstreaming_test.go:1:package fasthttp\nargs_timing_test.go:1:package fasthttp\nhttp_timing_test.go:1:package fasthttp\nround2_64_test.go:3:package fasthttp\nbytesconv_table.go:1:package fasthttp\nargs_test.go:1:package fasthttp\nbytesconv_32.go:3:package fasthttp\nipv6.go:1:package fasthttp\nfasthttpproxy/socks5.go:1:package fasthttpproxy\nworkerpool.go:1:package fasthttp\nround2_32.go:3:package fasthttp\nfasthttpproxy/dialer.go:1:package fasthttpproxy\ntcpdialer.go:1:package fasthttp\n```"
  },
  {
    "finding_title": "Unbounded reflection of attacker-controlled request data enables denial of service",
    "verdict": "INVALID",
    "reasoning": "The reported vulnerability is located in `examples/helloworldserver/helloworldserver.go`, which is a standalone example application (`package main`). The threat model for this repository (a library/SDK) defines the attacker as code interacting with the library's public API and the trust boundary as the exported functions of the `fasthttp` package. Code in the `examples/` directory is not part of the library's public surface; it is documentation/demonstration code that is not imported or executed by downstream consumers of the library. Therefore, a vulnerability in this example code does not constitute a security vulnerability in the library itself. While the code in the example does reflect the raw request (which could be a security risk in a production application), it does not meet the criteria for a library vulnerability under the specified threat model because it is not reachable via the library's public API surface. Prior reviewers correctly identified that this is example code, not library code.\n\nCRUX: The vulnerable code is in an example file (examples/helloworldserver), not in the library's public API or core logic exposed to downstream consumers.\nGREP: package main",
    "elapsed": 16.5,
    "tokens": 4074,
    "tokens_in": 3832,
    "tokens_out": 242,
    "cost_usd": 0.00233544,
    "file": "examples/helloworldserver/helloworldserver.go",
    "round": 4,
    "grep_used": true,
    "grep_results": "GREP `package main`:\n```\nbytesconv_table_gen.go:3:package main\nexamples/host_client/hostclient.go:1:package main\nexamples/letsencrypt/letsencryptserver.go:1:package main\nexamples/helloworldserver/helloworldserver.go:1:package main\nexamples/fileserver/fileserver.go:5:package main\nexamples/client/client.go:1:package main\nexamples/multidomain/multidomain.go:1:package main\n```"
  },
  {
    "finding_title": "Unbounded reflection of attacker-controlled request data enables denial of service",
    "verdict": "INVALID",
    "reasoning": "The reported vulnerability is located in `examples/helloworldserver/helloworldserver.go`. This file is part of the `package main`, which indicates it is a standalone example application and not part of the `fasthttp` library's public API (which resides in `package fasthttp`). The provided threat model defines the attacker as code that calls the public API of the library and restricts the scope of vulnerabilities to the library's exported functions and core logic. Vulnerabilities in example code, documentation, or test files are explicitly out of scope for a library threat model, as they do not represent security flaws in the library's own logic that downstream consumers would inherit or encounter when importing the package. Furthermore, even if this were considered, `fasthttp` has internal default limits on request body sizes (`MaxRequestBodySize`) that mitigate the 'unbounded' allocation claim, but the primary disqualifier is that this code is not part of the library's attack surface.\n\nCRUX: The vulnerable code resides in an example application (package main) rather than the library's public API (package fasthttp), making it out of scope for the library threat model.\nGREP: package fasthttp",
    "elapsed": 18.6,
    "tokens": 4086,
    "tokens_in": 3833,
    "tokens_out": 253,
    "cost_usd": 0.00236886,
    "file": "examples/helloworldserver/helloworldserver.go",
    "round": 5,
    "grep_used": true,
    "grep_results": "GREP `package fasthttp`:\n```\nperipconn_test.go:1:package fasthttp\nround2_32_test.go:3:package fasthttp\nbrotli.go:1:package fasthttp\nheader_timing_test.go:1:package fasthttp\nfasthttpadaptor/adaptor.go:3:package fasthttpadaptor\nfasthttpadaptor/b2s.go:1:package fasthttpadaptor\nfasthttpadaptor/request.go:1:package fasthttpadaptor\nfasthttpadaptor/request_test.go:1:package fasthttpadaptor\nfasthttpadaptor/adaptor_test.go:1:package fasthttpadaptor\nipv6_test.go:1:package fasthttp\nstreaming.go:1:package fasthttp\nuri_test.go:1:package fasthttp\nuserdata_test.go:1:package fasthttp\nbytesconv_64_test.go:3:package fasthttp\nstatus.go:1:package fasthttp\nfs_test.go:1:package fasthttp\nstream_timing_test.go:1:package fasthttp\nstreaming_test.go:1:package fasthttp\nhttp_timing_test.go:1:package fasthttp\nround2_64_test.go:3:package fasthttp\nargs_test.go:1:package fasthttp\nargs_timing_test.go:1:package fasthttp\nbytesconv_32.go:3:package fasthttp\nipv6.go:1:package fasthttp\nbytesconv_table.go:1:package fasthttp\nworkerpool.go:1:package fasthttp\nround2_32.go:3:package fasthttp\ntcpdialer.go:1:package fasthttp\nfasthttpproxy/socks5.go:1:package fasthttpproxy\nfasthttpproxy/dialer.go:1:package fasthttpproxy\n```"
  }
]

Raw scan report for this file

This file is a small example HTTP server built on `fasthttp`. The remote attacker controls the incoming HTTP request: method, URI, query string, host header, user-agent, connection metadata, and the request body. The handler does not use request data in any dangerous computation, path, SQL, command, or memory-manipulation path. It mainly formats request fields into the response.

The main security concerns are availability and response-handling issues:

1. **Unbounded request reflection / resource exhaustion**:
`requestHandler` writes `&ctx.Request` with `%s`. In `fasthttp`, this invokes the `Request.String()` representation, which can include the full request body. The server is started with `fasthttp.ListenAndServe` without configuring explicit bounds such as `MaxRequestBodySize`, `ReadTimeout`, `WriteTimeout`, `IdleTimeout`, or connection limits. A remote client can therefore send a very large or slow request and cause the server to allocate, process, and respond with an equally large payload. If `-compress` is enabled, `fasthttp.CompressHandler` can add additional CPU/buffering pressure.

2. **Missing server-level resource limits**:
`main` uses the default `fasthttp` server configuration. Without explicit timeouts and limits, an attacker can tie up goroutines, hold connections open, or exhaust memory through slow or oversized requests.

3. **Reflected request data without cache/MIME-sniffing hardening**:
The response echoes many attacker-controlled fields and the raw request. Although the content type is set to `text/plain`, the response does not set `X-Content-Type-Options: nosniff` or `Cache-Control: no-store`/`Vary`. This is low severity here, but it could matter in deployments with legacy clients or shared HTTP caches, because requester-specific fields such as `User-Agent`, `RemoteIP`, or raw request contents could be misinterpreted or cached/replayed.

```json
[
{
"severity": "high",
"title": "Unbounded reflection of attacker-controlled request data enables denial of service",
"function": "requestHandler",
"description": "The handler prints &ctx.Request with %s, causing fasthttp.Request.String() to serialize the entire request, including the attacker-controlled body. The server is started without an explicit fasthttp MaxRequestBodySize or other body-size bound, so a remote client can send a very large request and force the server to allocate, process, and write a response of comparable size. If -compress is enabled, fasthttp.CompressHandler adds compression CPU/buffering overhead. This can lead to memory exhaustion and denial of service."
},
{
"severity": "medium",
"title": "Default fasthttp server is used without timeouts, body-size, or concurrency limits",
"function": "main",
"description": "fasthttp.ListenAndServe(*addr, h) relies on default Server settings. The code does not configure ReadTimeout, WriteTimeout, IdleTimeout, MaxRequestBodySize, MaxConnsPerIP, or similar bounds. Remote attackers can send slow requests or open many connections to tie up goroutines and resources, resulting in availability impact."
},
{
"severity": "low",
"title": "Reflected request fields are served without cache and MIME-sniffing hardening",
"function": "requestHandler",
"description": "The response echoes Method, RequestURI, Path, Host, QueryArgs, UserAgent, RemoteIP, and the raw request. Content-Type is text/plain, but the handler does not set X-Content-Type-Options: nosniff or Cache-Control: no-store / Vary. A legacy client could MIME-sniff reflected content, and an intermediate HTTP cache could store and replay a personalized response, potentially leaking requester-specific data such as User-Agent, RemoteIP, or raw request headers/body."
}
]
```