mongoose/resources/specs/areas/common_misc.md

Security Scan Area: common_misc

Target

Area: common_misc

This area covers common utility code, parsing/string/formatting helpers, URL handling, hash/base64 helpers, filesystem backends, little filesystem integration, and flash support.

Primary files:

• src/base64.c
• src/fmt.c
• src/json.c
• src/log.c
• src/md5.c
• src/printf.c
• src/sha1.c
• src/sha256.c
• src/str.c
• src/url.c
• src/util.c
• src/fs*.c
• src/lfs.c
• src/flash.c

Perform a focused security review centered on these files and this security surface.

Supporting code elsewhere under src/ may be inspected when necessary to establish reachability, data flow, state, validation, mitigation, or impact, but do not inspect or report code outside src/ or independently review unrelated areas.

Area-Specific Security Guidance

Filesystem Backends:

• Review packed filesystem code and filesystem backends for traversal, unauthorized file read/write, overwrite, or truncation.
• Check path canonicalization across POSIX, Windows, embedded filesystems, packed filesystems, and custom mg_fs implementations.
• Look for trailing slash confusion, NUL byte truncation, and case sensitivity differences in backend path handling.

URL Parsing:

• Review URL parsing for scheme, host, port, IPv6 literal, userinfo, percent-encoding, embedded NUL, empty host, default port, and path/query boundary confusion.
• Check for SSRF-relevant behavior only when attacker input can control the destination host, protocol, or network boundary. Path-only control is not sufficient.