-
Notifications
You must be signed in to change notification settings - Fork 49
Open
Description
Description
The Flask backend accepts GDB commands from the frontend and executes them
without proper input validation or sanitization. This is both a security
concern and a reliability issue that can crash the server.
Problem
- No validation on incoming command input — empty/null strings crash the server
- No standardized JSON error response format — frontend cannot handle failures
- Missing proper HTTP status codes on error (returns 200 even on failures)
- No try/except around GDB command execution in the backend
Steps to Reproduce
- Send an empty string or null as a GDB command via the API
- Observe server crash or unhandled exception in terminal
- Frontend receives no meaningful error to display
Proposed Solution
- Add input validation using Flask request parsing with checks for empty input
- Return proper HTTP status codes:
400for bad input,500for server errors - Wrap all GDB command execution in
try/exceptblocks - Return structured JSON error responses:
{"error": "message", "status": 400} - Add basic sanitization to reject null or empty command strings
I'd like to fix this
Will explore /gdbui_server/main.py and submit a focused PR.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels