Panic in server when sending non-ASCII header value
- Dominant language
- Rust
- Stars
- 166
- Forks
- 49
- PR merge metrics
- No merged PRs in 30d
Description
Found via fuzzing.
Steps to reproduce:
1. run the server example (`cargo run --example=server`)
2. feed it the bad input (`cat crash | nc localhost 8080`)
`crash` is
```
GET https://example.com HTTP/1.1
Host:ȃ
```
and as base64 (to avoid encoding issues)
```
R0VUIGh0dHBzOi8vZXhhbXBsZS5jb20gSFRUUC8xLjEKSG9zdDrIgw0KDQo=
```
Full backtrace is long, I put it in the below gist.
https://gist.github.com/5225225/dd931721233609b6e6ce39d0705b0119
Contributor guide
Research direction
Start with the `server` example using `cargo run --example=server`, then reproduce the panic by sending the provided `crash` input with netcat. Use the linked gist backtrace to trace the failure, and confirm the server handles the non-ASCII header value without panicking.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- backend-api-design, networking
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100