Hacker News new | past | comments | ask | show | jobs | submit
TacticalCoder | on: Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
I really don't understand how so many different things are affected by the same brotli bug/exploit.

I even read the patch for the C code (patch which, btw, seems a bit hacky to me with isSafe? methods added and whatnots but YMMV: now I understand things had to be patched in a hurry but this patch really looks like "lipstick on a buffer overflowing C pig" to me).

What's the link between Python / Node / C++ / libbrotli / Envoy / Bun: are those some all using the same C brotli encoder/decoder?

Can someone who knows more explain why all those are vulnerable?

> As for unaffected software, Apache’s standard mod_brotli does not decode Brotli

Because this one only encodes and doesn't decode and the bug is in the decoder? (for I take it mod_brotli, with such a name, still does something brotli related and isn't, say, a TOTP token generator nor a SAT solver?).

I mean overall, sheesh: could we get better explanation / better writeups when such big fuckups happen?

Rapzid | parent | next
Yes. All these language runtimes compile against common libraries. Compression libs are one of the most common common libraries that platforms like node, ruby, dotnet, python, and etc need to compile.

Google provides the Brotli implementation. Package maintainers slurp that up and create ie libbrotli-dev. When you compile node it uses that for brotli support.

thephyber | parent
Brotli was a library released by the Google team that developed it. There weren't lots of independent implementations; they were all from the same source code.
rfgplk | root | parent
Or you can roll your own and not rely on the literal disaster that Google developed. Brotli is trivial to implement.
thephyber | root | parent
Well did you?

Your comment is irrelevant to mine. I stated what is, while you stated what ought to be.

It's trivial to make any open source repo that nobody uses. It's hard to get people to adopt your library over one supported by one of the world's largest companies.