envoyproxy/envoy

HTTP/2 codec: Audit ASSERTs

Open

#14,960 opened on Feb 5, 2021

View on GitHub
 (0 comments) (0 reactions) (1 assignee)C++ (5,373 forks)batch import
area/httparea/securityhelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

This issue describes a scan of ASSERTs in the HTTP/2 codec and recommendations to change some: https://gist.github.com/asraa/eb8b90a6398d202dd584cf403e3c6f3a

Those marked with a verdict have been audited or unknown if they need a pair of eyes.

Contributor guide

Research direction
Review the gist from asraa and examine each ASSERT location in codec impl.cc to determine if they can be triggered by malformed HTTP/2 frames, and whether they should be changed to more graceful error handling.
Tech stack
cpp
Domain
backend
Issue type
Research
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
C++HTTP/2
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30