http-rs / http-rs/surf

Denial of service when the server sends an infinitely large header

Open
#298 0 comments 1 reaction 0 assignees View on GitHub
bug
Dominant language
Rust
Stars
1.5k
Forks
128
PR merge metrics
No merged PRs in 30d

Description

surf will use an unbounded amount of memory if the server sends a single infinitely large header. surf has some DoS prevention (see #289) but it only protects from an infinite amount of headers, not from a single infinitely large header.

You can reproduce the issue by running the following in Linux console and then connecting to `localhost:8080` with surf:

`( echo -e "HTTP/1.1 200 OK\r"; echo -n "Huge-header: "; yes A | tr -d '\n' ) | nc -l localhost 8080`

Tested using [this code](https://github.com/Shnatsel/rust-http-clients-smoke-test/blob/f206362f2e81521bbefb84007cdd25242f6db590/surf-smoke-test/src/main.rs) for surf. You can inspect the Cargo.lock to know the exact dependency versions.

I've only tested the async-h1 backend; I don't know if the other backends are affected.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue with the Linux console command in the report, then inspect the async-h1 backend and the dependency versions recorded in Cargo.lock. Compare this behavior with the existing DoS prevention from #289. Done means a single unbounded response header no longer causes unbounded memory use, with the affected backend behavior covered by a test if the existing test layout identifies a suitable location.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.