1
- # Claude Debug
1
+ # Claude Debug
2
2
"""Test for HackerOne vulnerability report #3156202 - malformed input DOS."""
3
3
4
4
import anyio
@@ -23,12 +23,8 @@ async def test_malformed_initialize_request_does_not_crash_server():
23
23
instead of crashing the server (HackerOne #3156202).
24
24
"""
25
25
# Create in-memory streams for testing
26
- read_send_stream , read_receive_stream = anyio .create_memory_object_stream [
27
- SessionMessage | Exception
28
- ](10 )
29
- write_send_stream , write_receive_stream = anyio .create_memory_object_stream [
30
- SessionMessage
31
- ](10 )
26
+ read_send_stream , read_receive_stream = anyio .create_memory_object_stream [SessionMessage | Exception ](10 )
27
+ write_send_stream , write_receive_stream = anyio .create_memory_object_stream [SessionMessage ](10 )
32
28
33
29
try :
34
30
# Create a malformed initialize request (missing required params field)
@@ -38,7 +34,7 @@ async def test_malformed_initialize_request_does_not_crash_server():
38
34
method = "initialize" ,
39
35
# params=None # Missing required params field
40
36
)
41
-
37
+
42
38
# Wrap in session message
43
39
request_message = SessionMessage (message = JSONRPCMessage (malformed_request ))
44
40
@@ -54,22 +50,22 @@ async def test_malformed_initialize_request_does_not_crash_server():
54
50
):
55
51
# Send the malformed request
56
52
await read_send_stream .send (request_message )
57
-
53
+
58
54
# Give the session time to process the request
59
55
await anyio .sleep (0.1 )
60
-
56
+
61
57
# Check that we received an error response instead of a crash
62
58
try :
63
59
response_message = write_receive_stream .receive_nowait ()
64
60
response = response_message .message .root
65
-
61
+
66
62
# Verify it's a proper JSON-RPC error response
67
63
assert isinstance (response , JSONRPCError )
68
64
assert response .jsonrpc == "2.0"
69
65
assert response .id == "f20fe86132ed4cd197f89a7134de5685"
70
66
assert response .error .code == INVALID_PARAMS
71
67
assert "Invalid request parameters" in response .error .message
72
-
68
+
73
69
# Verify the session is still alive and can handle more requests
74
70
# Send another malformed request to confirm server stability
75
71
another_malformed_request = JSONRPCRequest (
@@ -78,21 +74,19 @@ async def test_malformed_initialize_request_does_not_crash_server():
78
74
method = "tools/call" ,
79
75
# params=None # Missing required params
80
76
)
81
- another_request_message = SessionMessage (
82
- message = JSONRPCMessage (another_malformed_request )
83
- )
84
-
77
+ another_request_message = SessionMessage (message = JSONRPCMessage (another_malformed_request ))
78
+
85
79
await read_send_stream .send (another_request_message )
86
80
await anyio .sleep (0.1 )
87
-
81
+
88
82
# Should get another error response, not a crash
89
83
second_response_message = write_receive_stream .receive_nowait ()
90
84
second_response = second_response_message .message .root
91
-
85
+
92
86
assert isinstance (second_response , JSONRPCError )
93
87
assert second_response .id == "test_id_2"
94
88
assert second_response .error .code == INVALID_PARAMS
95
-
89
+
96
90
except anyio .WouldBlock :
97
91
pytest .fail ("No response received - server likely crashed" )
98
92
finally :
@@ -109,12 +103,8 @@ async def test_multiple_concurrent_malformed_requests():
109
103
Test that multiple concurrent malformed requests don't crash the server.
110
104
"""
111
105
# Create in-memory streams for testing
112
- read_send_stream , read_receive_stream = anyio .create_memory_object_stream [
113
- SessionMessage | Exception
114
- ](100 )
115
- write_send_stream , write_receive_stream = anyio .create_memory_object_stream [
116
- SessionMessage
117
- ](100 )
106
+ read_send_stream , read_receive_stream = anyio .create_memory_object_stream [SessionMessage | Exception ](100 )
107
+ write_send_stream , write_receive_stream = anyio .create_memory_object_stream [SessionMessage ](100 )
118
108
119
109
try :
120
110
# Start a server session
@@ -136,18 +126,16 @@ async def test_multiple_concurrent_malformed_requests():
136
126
method = "initialize" ,
137
127
# params=None # Missing required params
138
128
)
139
- request_message = SessionMessage (
140
- message = JSONRPCMessage (malformed_request )
141
- )
129
+ request_message = SessionMessage (message = JSONRPCMessage (malformed_request ))
142
130
malformed_requests .append (request_message )
143
-
131
+
144
132
# Send all requests
145
133
for request in malformed_requests :
146
134
await read_send_stream .send (request )
147
-
135
+
148
136
# Give time to process
149
137
await anyio .sleep (0.2 )
150
-
138
+
151
139
# Verify we get error responses for all requests
152
140
error_responses = []
153
141
try :
@@ -156,10 +144,10 @@ async def test_multiple_concurrent_malformed_requests():
156
144
error_responses .append (response_message .message .root )
157
145
except anyio .WouldBlock :
158
146
pass # No more messages
159
-
147
+
160
148
# Should have received 10 error responses
161
149
assert len (error_responses ) == 10
162
-
150
+
163
151
for i , response in enumerate (error_responses ):
164
152
assert isinstance (response , JSONRPCError )
165
153
assert response .id == f"malformed_{ i } "
@@ -169,4 +157,4 @@ async def test_multiple_concurrent_malformed_requests():
169
157
await read_send_stream .aclose ()
170
158
await write_send_stream .aclose ()
171
159
await read_receive_stream .aclose ()
172
- await write_receive_stream .aclose ()
160
+ await write_receive_stream .aclose ()
0 commit comments