PCBC-955: do not allow trailing garbage in encoded CAS value (#134)

couchbase · Oct 9, 2023 · dac7e56 · dac7e56
1 parent 2777e99
commit dac7e56
Show file tree

Hide file tree

Showing 2 changed files with 30 additions and 1 deletion.
diff --git a/src/wrapper/conversion_utilities.cxx b/src/wrapper/conversion_utilities.cxx
@@ -519,7 +519,13 @@ core_error_info
 cb_string_to_cas(const std::string& cas_string, couchbase::cas& cas)
 {
     try {
-        std::uint64_t cas_value = std::stoull(cas_string, nullptr, 16);
+        std::size_t end = 0;
+        const std::uint64_t cas_value = std::stoull(cas_string, &end, 16);
+        if (end != cas_string.size()) {
+            return { errc::common::invalid_argument,
+                     ERROR_LOCATION,
+                     fmt::format("trailing characters are not allowed in CAS value: \"{}\"", cas_string) };
+        }
         cas = couchbase::cas{ cas_value };
     } catch (const std::invalid_argument&) {
         return { errc::common::invalid_argument,

diff --git a/tests/KeyValueRemoveTest.php b/tests/KeyValueRemoveTest.php
@@ -20,6 +20,7 @@
 
 use Couchbase\DurabilityLevel;
 use Couchbase\Exception\CasMismatchException;
+use Couchbase\Exception\InvalidArgumentException;
 use Couchbase\Exception\DocumentNotFoundException;
 use Couchbase\RemoveOptions;
 
@@ -38,6 +39,28 @@ public function testRemoveThrowsCasMismatchForWrongCas()
         $collection->remove($id, RemoveOptions::build()->cas("deadbeef"));
     }
 
+    public function testRemoveThrowsCasMismatchForWrongCasGarbageSuffix()
+    {
+        $collection = $this->defaultCollection();
+        $id = $this->uniqueId();
+
+        $res = $collection->upsert($id, ["answer" => 42]);
+
+        $this->expectException(InvalidArgumentException::class);
+        $collection->remove($id, RemoveOptions::build()->cas($res->cas() . "-invalid"));
+    }
+
+    public function testRemoveThrowsCasMismatchForWrongCasGarbagePrefix()
+    {
+        $collection = $this->defaultCollection();
+        $id = $this->uniqueId();
+
+        $res = $collection->upsert($id, ["answer" => 42]);
+
+        $this->expectException(InvalidArgumentException::class);
+        $collection->remove($id, RemoveOptions::build()->cas("invalid-" . $res->cas()));
+    }
+
     public function testRemoveThrowsDocumentNotFoundForUnknownId()
     {
         $collection = $this->defaultCollection();