Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def audit(self, freq, orig_response):
"""
Tests an URL for buffer overflow vulnerabilities.
:param freq: A FuzzableRequest
"""
mutants = create_mutants(freq, self.BUFFER_TESTS,
orig_resp=orig_response)
args = zip(repeat(self._send_request), mutants)
for result in self.worker_pool.imap_unordered(apply_with_return_error, args):
# re-raise the thread exception in the main thread with this method
# so we get a nice traceback instead of things like the ones we see
# in https://github.com/andresriancho/w3af/issues/7287
if isinstance(result, Error):
result.reraise()
except ProcessExpired:
# We reach here when the process died because of an error, we
# handle this just like when the parser takes a lot of time and
# we're unable to retrieve an answer from it
msg = ('One of the parser processes died unexpectedly, this could'
' be because of a bug, the operating system triggering OOM'
' kills, etc. The scanner will continue with the next'
' document, but the scan results might be inconsistent.')
raise TimeoutError(msg)
finally:
# Remove the temp file used to send data to the process, we already
# have the result, so this file is not needed anymore
remove_file_if_exists(filename)
# We still need to perform some error handling here...
if isinstance(process_result, Error):
if isinstance(process_result.exc_value, MemoryError):
msg = ('The parser exceeded the memory usage limit of %s bytes'
' while trying to parse "%s". The parser was stopped in'
' order to prevent OOM issues.')
args = (self.MEMORY_LIMIT, http_response.get_url())
om.out.debug(msg % args)
raise MemoryError(msg % args)
process_result.reraise()
try:
parser_output = load_object_from_temp_file(process_result)
except Exception, e:
msg = 'Failed to deserialize sub-process result. Exception: "%s"'
args = (e,)
raise Exception(msg % args)
# You can use this code to debug issues that happen in threads, by
# simply not using them:
#
# for i in iterable:
# callback(i, func(i))
# return
#
# Now the real code:
func = return_args(func, **kwds)
args = zip(repeat(func), iterable)
for result in imap_unordered(awre, args):
# re-raise the thread exception in the main thread with this method
# so we get a nice traceback instead of things like the ones we see
# in https://github.com/andresriancho/w3af/issues/7286
if isinstance(result, Error):
result.reraise()
else:
(mutant,), http_response = result
callback(mutant, http_response)
# You can use this code to debug issues that happen in threads, by
# simply not using them:
#
# for i in iterable:
# callback(i, func(i))
# return
#
# Now the real code:
func = return_args(func, **kwds)
args = zip(repeat(func), iterable)
for result in imap_unordered(awre, args):
# re-raise the thread exception in the main thread with this method
# so we get a nice traceback instead of things like the ones we see
# in https://github.com/andresriancho/w3af/issues/7286
if isinstance(result, Error):
result.reraise()
else:
(mutant,), http_response = result
callback(mutant, http_response)
try:
process_result = future.result()
except TimeoutError:
# We hit a timeout, return an empty list
return []
except ProcessExpired:
# We reach here when the process died because of an error
return []
finally:
# Remove the temp file used to send data to the process
remove_file_if_exists(filename)
# There was an exception in the parser, maybe the HTML was really
# broken, or it wasn't an HTML at all.
if isinstance(process_result, Error):
if isinstance(process_result.exc_value, MemoryError):
msg = ('The parser exceeded the memory usage limit of %s bytes'
' while trying to parse "%s". The parser was stopped in'
' order to prevent OOM issues.')
args = (self.MEMORY_LIMIT, http_response.get_url())
om.out.debug(msg % args)
return []
try:
filtered_tags = load_tags_from_temp_file(process_result)
except Exception, e:
msg = 'Failed to deserialize sub-process result. Exception: "%s"'
args = (e,)
raise Exception(msg % args)
finally: