744126 - [Security Review][Action Item]Snappy Symbolic Server - Code Review

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance, task)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

code is located here https://github.com/vdjeric/Snappy-Symbolication-Server/

Comment 1

[David Chan [:dchan]]

:vladan :lmandel

I've finishing reviewing the code and testing the server. There wasn't much to test since the fields were validated with regexes and there is a try/catch around most of the code.

Even if a thread dies, the server continues to run. I couldn't think of a way to DOS the server. I'll close off this bug when the blockers are addressed. 

The broken pipe error may have to be addressed with timeouts or something similar. I can't imagine the lookup taking more than a couple seconds.

Comment 2

[Vladan Djeric (:vladan)]

Patch with all the sec-review fixes: https://github.com/vdjeric/Snappy-Symbolication-Server/commit/67705706c605984e220f69469a68b455813923f5

I worked around the broken pipe problem by adding a 10 second timeout to the read from the connection socket.

I have marked the dependency bugs resolved, please re-open if that was the wrong thing to do.

Comment 3

[David Chan [:dchan]]

I went through and VERIFIED that the fixes caught the exceptions. Closing out this bug.