about summary refs log tree commit diff
path: root/users/Profpatsch
diff options
context:
space:
mode:
authorProfpatsch <mail@profpatsch.de>2021-01-29T15·35+0100
committerProfpatsch <mail@profpatsch.de>2021-01-31T11·10+0000
commitf0579313d31ac7fafe0f05ee55ecb305bc1cbe23 (patch)
tree498b2ee7e6daf59ff38aa43ced2fb4bb45bb38b1 /users/Profpatsch
parentcf3aab3b787acd05d1f15bf6e600c20f3196cb23 (diff)
fix(users/Profpatsch/read-http): actually parse ascii r/2174
There might be exploits since we parsed the headers as utf8 even
though we actually want to interpret them as ASCII.

This fixes it, by using the ascii crate.

Thanks to @sterni for noticing.

Change-Id: I50b6a588d99b34e677cb22968cf0dfd8b331d11c
Reviewed-on: https://cl.tvl.fyi/c/depot/+/2457
Reviewed-by: Profpatsch <mail@profpatsch.de>
Tested-by: BuildkiteCI
Diffstat (limited to 'users/Profpatsch')
-rw-r--r--users/Profpatsch/read-http/default.nix1
-rw-r--r--users/Profpatsch/read-http/read-http.rs7
-rw-r--r--users/Profpatsch/rust-crates.nix7
3 files changed, 12 insertions, 3 deletions
diff --git a/users/Profpatsch/read-http/default.nix b/users/Profpatsch/read-http/default.nix
index 20f8675b3fd4..41fe1c7fedcc 100644
--- a/users/Profpatsch/read-http/default.nix
+++ b/users/Profpatsch/read-http/default.nix
@@ -6,6 +6,7 @@ let
   read-http = depot.users.Profpatsch.writers.rustSimple {
     name = "read-http";
     dependencies = [
+      depot.users.Profpatsch.rust-crates.ascii
       depot.users.Profpatsch.rust-crates.httparse
       depot.users.Profpatsch.netencode.netencode-rs
       depot.users.Profpatsch.arglib.netencode.rust
diff --git a/users/Profpatsch/read-http/read-http.rs b/users/Profpatsch/read-http/read-http.rs
index a43bb7d3b20b..ab2c3887d7b5 100644
--- a/users/Profpatsch/read-http/read-http.rs
+++ b/users/Profpatsch/read-http/read-http.rs
@@ -1,6 +1,7 @@
 extern crate httparse;
 extern crate netencode;
 extern crate arglib_netencode;
+extern crate ascii;
 
 use std::os::unix::io::FromRawFd;
 use std::io::Read;
@@ -63,11 +64,11 @@ fn main() -> std::io::Result<()> {
     fn normalize_headers<'a>(headers: &'a [httparse::Header]) -> Vec<(String, &'a str)> {
         let mut res = vec![];
         for httparse::Header { name, value } in headers {
-            let val = std::str::from_utf8(*value)
-                .expect(&format!("read-http: we require header values to be UTF-8 (they should be ASCII), but the header {} was {:?}", name, value));
+            let val = ascii::AsciiStr::from_ascii(*value)
+                .expect(&format!("read-http: we require header values to be ASCII, but the header {} was {:?}", name, value));
             // lowercase the headers, since the standard doesn’t care
             // and we want unique strings to match agains
-            res.push((name.to_lowercase(), val))
+            res.push((name.to_lowercase(), val.as_str()))
         }
         res
     }
diff --git a/users/Profpatsch/rust-crates.nix b/users/Profpatsch/rust-crates.nix
index bb65625fc758..96734187eadb 100644
--- a/users/Profpatsch/rust-crates.nix
+++ b/users/Profpatsch/rust-crates.nix
@@ -14,6 +14,13 @@ rec {
     sha256 = "12q71z6ck8wlqrwgi25x3lrryyks9djymswn9b1c6qq0i01jpc1p";
   };
 
+  ascii = pkgs.buildRustCrate {
+    pname = "ascii";
+    crateName = "ascii";
+    version = "1.0.0";
+    sha256 = "0gam8xsn981wfa40srsniivffjsfz1pg0xnigmczk9k7azb1ks1m";
+  };
+
   regex-syntax = pkgs.buildRustCrate {
     pname = "regex-syntax";
     crateName = "regex-syntax";