hyperium / hyperium/http

Request::connect can build an invalid Request object

Open
#494 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
1.4k
Forks
378
Avg merge
1d 21h
Merged PRs (30d)
5

Description

According to RFC2817, Section 5.2 the URI of the CONNECT method should be only the authority part:

A CONNECT method requests that a proxy establish a tunnel connection
on its behalf. The Request-URI portion of the Request-Line is always
an 'authority' as defined by URI Generic Syntax [2], which is to say
the host name and port number destination of the requested connection
separated by a colon:

However with the http 0.2.4 crate it is possible to create a CONNECT request with an invalid URI part.

Example:

use http::Request;
use http::Uri;

fn main() {
    let u: Uri = "http://example.org/index.html".parse().unwrap();
    let r = Request::connect(u).body(()).unwrap();
    dbg!(&r);
}

Output:

[src/main.rs:7] &r = Request {
    method: CONNECT,
    uri: http://example.org/index.html,
    version: HTTP/1.1,
    headers: {},
    body: (),
}

Rust Playground Link

Available options are:

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading Request::connect and the Uri::authority documentation, then trace the body() call shown in the example. Resolve which RFC 2817 behavior is intended and verify that constructing a CONNECT request cannot preserve an invalid full URI.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.