Aias00 opened a new pull request, #3525:
URL: https://github.com/apache/dubbo-go/pull/3525
## What
`unpackRequestBody` panics on an unchecked `argsTypes.(string)` assertion
when the argument-types descriptor field of a Dubbo Hessian2 request is a
Hessian `null` (or any non-string), crashing the server-side goroutine handling
the request.
## Why
```go
// protocol/dubbo/hessian2/hessian_request.go:226-232
argsTypes, err = decoder.Decode()
if err != nil {
return perrors.WithStack(err)
}
req[4] = argsTypes
ats := DescRegex.FindAllString(argsTypes.(string), -1) // unchecked
assertion
```
`decoder.Decode()` returns `(nil, nil)` for a Hessian null marker (no
error), so a malformed/hostile request whose argsTypes field is null reaches
the assertion and panics — dropping the connection / tripping `recover`.
## Fix
Comma-ok assertion; on a non-string argsTypes, return a descriptive error
instead of panicking. An empty-string argsTypes (zero args) still decodes
unchanged.
```go
argsTypesStr, ok := argsTypes.(string)
if !ok {
return perrors.Errorf("hessian2: invalid argument types descriptor,
expected string, got %T", argsTypes)
}
ats := DescRegex.FindAllString(argsTypesStr, -1)
```
## Tests
Added `TestUnpackRequestBody_NilArgsTypes`: encodes a request whose
argsTypes field is a Hessian null and asserts `unpackRequestBody` returns an
error (no panic). `protocol/dubbo/hessian2` package passes.
Fixes #3524
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
