-
Notifications
You must be signed in to change notification settings - Fork 74
Avoid panics in NgxListIterator, ngx_str_t::to_str #183
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
67c967a
to
479f08c
Compare
The NgxListIterator bug was discovered by @xeioex so I'll tag him for review |
I believe we need more time to think for this Header iterator interface as there are a lot of things to consider.
Also looking at RFC9110
Treating the headers as bytes simplifies things for us in ngx-rust, but I am not sure it is very convenient for users. |
479f08c
to
0afa1af
Compare
Rewritten according to feedback |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good, just one small nit.
0afa1af
to
8c30f7c
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ngx::http::NgxListIterator: ngx_str_t items are NgxStr, not str
to better adhere to commit log notation in the repo I suggest to replace it to something like
fix: use NgxStr in NgxListIterator to prevent UTF-8 panics
and
ngx_str_t::to_str should not unwrap.
to
fix(sys): replace panicking ngx_str_t::to_str with fallible variant
otherwise looks good
ngx::http::NgxListIterator ngx_str_t items are now NgxStr, not str. The ngx_str_items in the header name and value are often untrusted input, and may not have utf-8 contents. The use of ngx_str_t::to_str in this iterator will panic when the contents are not utf-8. So, instead of yielding a pair of strs here, yield a pair of &NgxStr, which is like ngx_str_t but with more methods.
ngx_str_t::to_str should not contain an unwrap. In general, we should avoid exposing methods that panic when its reasonable to return a Result instead. This particular method was used, likely without considering that it may panic or validating that the contents are utf-8, in ngx::http::NgxListIterator's Iterator impl, which made it very easy to panic based on untrusted input.
8c30f7c
to
11bdc20
Compare
Commit titles rewritten |
Proposed changes
ngx::http::NgxListIterator: ngx_str_t items may not be str:
The ngx_str_items in the header name and value are often untrusted
input, and may not have utf-8 contents. The use of ngx_str_t::to_str
in this iterator will panic when the contents are not utf-8. So, instead
of yielding a pair of strs here, yield a pair of &NgxStr.
ngx_str_t::to_str should not unwrap
In general, we should avoid exposing methods that panic when its
reasonable to return a Result instead. This particular method was used,
likely without considering that it may panic or validating that the
contents are utf-8, in ngx::http::NgxListIterator's Iterator impl,
which made it very easy to panic based on untrusted input.
Checklist
Before creating a PR, run through this checklist and mark each as complete.