dotnet / dotnet/aspnetcore

Ensure all public PipeWriters return zero'd memory

Open
#12,632 3 comments 0 reactions 0 assignees View on GitHub
affected-very-few area-networking enhancement severity-minor
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

HttpResponse.PipeWriter.GetMemory/Span pulls from the configured memory pool. The default pool does not zero memory. This can be problematic if the caller does not overwrite every bit.

Proposal: Audit AspNetCore and ensure all HttpResponse.PipeWriter instances are configured with a pool that zeros memory.

Some instances:
https://github.com/aspnet/AspNetCore/blob/4aebd29abca80242f5ff9e89e07d4f1b28788a44/src/Servers/IIS/IIS/src/Core/IISHttpContext.FeatureCollection.cs#L197
https://github.com/aspnet/AspNetCore/blob/4aebd29abca80242f5ff9e89e07d4f1b28788a44/src/Servers/HttpSys/src/FeatureContext.cs#L380
https://github.com/aspnet/AspNetCore/blob/4aebd29abca80242f5ff9e89e07d4f1b28788a44/src/Hosting/TestHost/src/HttpContextBuilder.cs#L46
https://github.com/aspnet/AspNetCore/blob/4aebd29abca80242f5ff9e89e07d4f1b28788a44/src/Servers/Kestrel/Core/src/Internal/Http/HttpProtocol.cs#L248
https://github.com/aspnet/AspNetCore/blob/4aebd29abca80242f5ff9e89e07d4f1b28788a44/src/Middleware/ResponseCompression/src/ResponseCompressionBody.cs#L90
https://github.com/aspnet/AspNetCore/blob/4aebd29abca80242f5ff9e89e07d4f1b28788a44/src/Http/Http/src/StreamResponseBodyFeature.cs#L62

Contributor guide

Open the contributing guide

Research direction

Audit the HttpResponse.PipeWriter instances named in IISHttpContext.FeatureCollection.cs, FeatureContext.cs, HttpContextBuilder.cs, HttpProtocol.cs, ResponseCompressionBody.cs, and StreamResponseBodyFeature.cs. Start by comparing how each instance obtains its memory pool. Done means all public PipeWriter GetMemory/Span paths use a pool that returns zeroed memory.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.