Skip to content

[Bug] fix: Backend has no input validation on GDB command execution #144

@Lalit7374

Description

@Lalit7374

Description

The Flask backend accepts GDB commands from the frontend and executes them
without proper input validation or sanitization. This is both a security
concern and a reliability issue that can crash the server.

Problem

  • No validation on incoming command input — empty/null strings crash the server
  • No standardized JSON error response format — frontend cannot handle failures
  • Missing proper HTTP status codes on error (returns 200 even on failures)
  • No try/except around GDB command execution in the backend

Steps to Reproduce

  1. Send an empty string or null as a GDB command via the API
  2. Observe server crash or unhandled exception in terminal
  3. Frontend receives no meaningful error to display

Proposed Solution

  • Add input validation using Flask request parsing with checks for empty input
  • Return proper HTTP status codes: 400 for bad input, 500 for server errors
  • Wrap all GDB command execution in try/except blocks
  • Return structured JSON error responses: {"error": "message", "status": 400}
  • Add basic sanitization to reject null or empty command strings

I'd like to fix this

Will explore /gdbui_server/main.py and submit a focused PR.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions