Denial of service when the server sends an infinitely large header
- Dominant language
- Rust
- Stars
- 1.5k
- Forks
- 128
- PR merge metrics
- No merged PRs in 30d
Description
surf will use an unbounded amount of memory if the server sends a single infinitely large header. surf has some DoS prevention (see #289) but it only protects from an infinite amount of headers, not from a single infinitely large header.
You can reproduce the issue by running the following in Linux console and then connecting to `localhost:8080` with surf:
`( echo -e "HTTP/1.1 200 OK\r"; echo -n "Huge-header: "; yes A | tr -d '\n' ) | nc -l localhost 8080`
Tested using [this code](https://github.com/Shnatsel/rust-http-clients-smoke-test/blob/f206362f2e81521bbefb84007cdd25242f6db590/surf-smoke-test/src/main.rs) for surf. You can inspect the Cargo.lock to know the exact dependency versions.
I've only tested the async-h1 backend; I don't know if the other backends are affected.
Contributor guide
Research direction
Start by reproducing the issue with the Linux console command in the report, then inspect the async-h1 backend and the dependency versions recorded in Cargo.lock. Compare this behavior with the existing DoS prevention from #289. Done means a single unbounded response header no longer causes unbounded memory use, with the affected backend behavior covered by a test if the existing test layout identifies a suitable location.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100