Weakness (CWE)
CWE-135: Incorrect Calculation of Multi-Byte String Length
Base Draft
The product does not correctly calculate the length of strings that can contain wide or multi-byte characters.
How to prevent it (2 mitigations)
-
Implementation
Always verify the length of the string unit character.
-
Implementation
Use length computing functions (e.g. strlen, wcslen, etc.) appropriately with their equivalent type (e.g.: byte, wchar_t, etc.)
Source: MITRE CWE-135
1 result · Clear filters · Feed
-
Medium 4.8
Rack: Content-Length mismatch in Rack::Files error responses
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Files#fail sets the Content-Length response header using String#size instead of String#bytesize. When the response body contains multibyte UTF-8 characters, the de…