Long URLs can cause seemingly exponential parse times, which makes untrusted input problematic
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 1.6k
- Forks
- 406
- PR merge metrics
- No merged PRs in 30d
Description
Please find attached three URLs that were generated by a fuzzer - all of them take more than 25s (in debug mode) to parse with url::Url::parse(long_url).
About Security
I was advised to open an issue here after getting in touch privately at first as per Security Policy.
Possible Fix
It seems feasible to limit the host-name length, which is the portion that causes long parsing times, to smaller values that can't be exploited. The current internet has limits for host-names as well which would be safe to parse.
Workaround
For now the only known way is to inspect the URL prior to passing it to url for parsing. However, at least with gix-url that's easier said than done as the fuzzer keeps finding bypasses for the extra-logic that I put into place.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the public url::Url::parse(long_url) entry point and reproduce the reported timings with the three URLs in long-urls.zip. Investigate the hostname portion identified as causing the slow parsing, then verify that the attached inputs no longer cause excessive parse times while valid current-internet hostnames remain parseable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- networking, performance, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100