whois-parser: Crash Index out of range in prepareEDU

Hello @mnakama @skalniy This has been fixed, please try the latest version.

If you think this repository is helpful, please share it with friends, thanks.

@mnakama panic/recover make code more clear. please refer to error handing with go2.0, is just something like panic/recover.

func main() {
	handle err {
		log.Fatal(err)
	}

	hex := check ioutil.ReadAll(os.Stdin)
	data := check parseHexdump(string(hex))
	os.Stdout.Write(data)
}

I wrote this libary and share it without reservation, I paid a lot of time to it and ask for nothing. But that is not the reason that you can just thow a trouble and ask for fixing without having any willing to give me any help. If that, You are not welcome, please immediately stop importing this libary.

what domains are returning data that causes the panic

It’s not domains causing the panic it’s bad code that takes input without validation. If this was developed in C you’d have a potential RCE vulnerability at hand.

Never trust arbitrary input - in this case from a remote Whois server.

If you want to teach me how to validate the input, then I want to teach you how to reslove a problem:

• step 1: catch a problem
• step 2: find out the reason
• step 3: fix the problem

We never do something like you:

• step 1: catch a problem
• step 2: skip the problem
• step 3: there is no problem

Since you are loving C so much, PLEASE keep away from my go libary and write a parser using C youself!

@Kleissner thanks, that’s what I meant to say, but your wording is much better: “Never trust arbitrary input”.

The design of the current parsing engine puts way too much trust in whois servers. There are other domains that look like they could run past the array bounds if given strange input, but I haven’t had any panics once I implemented this small patch.

I don’t want to criticize the code too much, though, since I’m grateful that I didn’t have to write domain lookup parsing myself. Thanks to @likexian for making this library =)

what domains are returning data that causes the panic

It’s not domains causing the panic it’s bad code that takes input without validation. If this was developed in C you’d have a potential RCE vulnerability at hand.

Never trust arbitrary input - in this case from a remote Whois server.

Of course you can! Just add a check if index >= len(tokens[token]) break. There fixed it for ya.

This way just skip the problem but not reslove the problem, the parsing result is wrong.

If I can not reproduce it, i can not fix it.