Ensure all public PipeWriters return zero'd memory
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
HttpResponse.PipeWriter.GetMemory/Span pulls from the configured memory pool. The default pool does not zero memory. This can be problematic if the caller does not overwrite every bit.
Proposal: Audit AspNetCore and ensure all HttpResponse.PipeWriter instances are configured with a pool that zeros memory.
Some instances:
https://github.com/aspnet/AspNetCore/blob/4aebd29abca80242f5ff9e89e07d4f1b28788a44/src/Servers/IIS/IIS/src/Core/IISHttpContext.FeatureCollection.cs#L197
https://github.com/aspnet/AspNetCore/blob/4aebd29abca80242f5ff9e89e07d4f1b28788a44/src/Servers/HttpSys/src/FeatureContext.cs#L380
https://github.com/aspnet/AspNetCore/blob/4aebd29abca80242f5ff9e89e07d4f1b28788a44/src/Hosting/TestHost/src/HttpContextBuilder.cs#L46
https://github.com/aspnet/AspNetCore/blob/4aebd29abca80242f5ff9e89e07d4f1b28788a44/src/Servers/Kestrel/Core/src/Internal/Http/HttpProtocol.cs#L248
https://github.com/aspnet/AspNetCore/blob/4aebd29abca80242f5ff9e89e07d4f1b28788a44/src/Middleware/ResponseCompression/src/ResponseCompressionBody.cs#L90
https://github.com/aspnet/AspNetCore/blob/4aebd29abca80242f5ff9e89e07d4f1b28788a44/src/Http/Http/src/StreamResponseBodyFeature.cs#L62
Contributor guide
Research direction
Audit the HttpResponse.PipeWriter instances named in IISHttpContext.FeatureCollection.cs, FeatureContext.cs, HttpContextBuilder.cs, HttpProtocol.cs, ResponseCompressionBody.cs, and StreamResponseBodyFeature.cs. Start by comparing how each instance obtains its memory pool. Done means all public PipeWriter GetMemory/Span paths use a pool that returns zeroed memory.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100