Nweb: a tiny, safe web server (static pages only)
1–10 of 63 posts
Re: Nweb: a tiny, safe web server (static pages only)
#2Not a prank!
Re: Nweb: a tiny, safe web server (static pages only)
#3The only thing safer about this that I see is it is extremely small. No high assurance design, etc. What am I missing here that makes them advertise its safety?
Re: Nweb: a tiny, safe web server (static pages only)
#4Just because the code is tiny doesn't mean that it is safe. How do we know that the code is not vulnerable to e.g. buffer overflow exploit?
Re: Nweb: a tiny, safe web server (static pages only)
#5I am always on the look out for a small, lightweight and secure web server for impromptu file sharing. Right now I use publicfile from djb.[^1] My only complaint is that there is no debian package for publicfile so I have to build my own package. I would love to find an equivalent (ftp not necessary) daemon that is included in debian. Is anyone aware of a something in debian repos that I am overlooking?
Re: Nweb: a tiny, safe web server (static pages only)
#6http://www.ibm.com/developerworks/systems/library/es-nweb/si... Direct link to the (200 lines of) source code. I can't speak to the security, but it is a nice little read.
Re: Nweb: a tiny, safe web server (static pages only)
#7Just because the code is tiny doesn't mean that it is safe. How do we know that the code is not vulnerable to e.g. buffer overflow exploit?
I find your comment particularly funny, because in the information security course I took for my masters degree, we had to perform remote buffer overflow exploits using an older version of this exact software.
Re: Nweb: a tiny, safe web server (static pages only)
#8This code is really not good, and certainly not worth learning from.
It appears that if you request a path like "//etc/foobar" with two slashes at the front it'll allow traversal outside the starting directory, though it's mitigated by checking file extensions.
Re: Nweb: a tiny, safe web server (static pages only)
#9This code is really not good, and certainly not worth learning from. It appears that if you request a path like "//etc/foobar" with two slashes at the front it'll allow traversal outside the starting directory, though it's mitigated by checking file extensions.
That may be, but the docs are quite nice; people who can write better code might still gain from considering how they can make their documentation this instructive.
Re: Nweb: a tiny, safe web server (static pages only)
#10My C is a little rusty, but it seems like this web server is definitely not safe. The very first function in the code has a local stack variable and uses sprintf() to fill it. That's almost a textbook example of a buffer overflow vulnerability, if I'm not mistaken. Even if they try and compensate for that by checking the data length before it's passed to that function, it's still scary to see someone using sprintf() instead of snprintf() these days. It's like walking a tightrope without a net.