Raw fragments in :path are discarded before request-target validation
Maintainers usually reply within 1 day
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 20/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Stale
- Tech stack
- rust
- Domain
- networking
Research direction
Read the :path handling around PathAndQuery conversion and the existing RST_STREAM(PROTOCOL_ERROR) path. Check the relevant tests or add coverage for literal # rejection and valid %23 preservation in paths and queries. Done means literal fragments are rejected before URI conversion while percent-encoded hashes remain valid; a linked pull request is already open.
Written by the indexing model from the issue text.
Description
A literal # in :path is silently stripped by PathAndQuery, including any invalid bytes in the fragment suffix, so the application receives a different request target. HTTP/2 defines :path as the path and optional query, not a fragment. Reject literal # before URI conversion using the existing RST_STREAM(PROTOCOL_ERROR) path, while preserving valid percent-encoded %23 in paths and queries.
- Dominant language
- Rust
- Stars
- 1.6k
- Forks
- 395
- Avg merge
- 6h 3m
- Merged PRs (30d)
- 8
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from hyperium/h2
-
Difficulty 2/5 1-3 hours Newbie friendliness 80/100
Maintainers usually reply within 1 day
-
Oversized trailers bypass max_header_list_size and are silently truncatedPossibly taken @cfal claimed this 2 days ago. Open
Difficulty 4/5 3-5 days Newbie friendliness 20/100
Maintainers usually reply within 1 day
-
Pseudo-header fields in trailers are silently discardedPossibly taken @cfal claimed this 2 days ago. Open
Difficulty 3/5 1-2 days Newbie friendliness 25/100
Maintainers usually reply within 1 day
-
Trailers after a chained DATA frame always cost a second writePossibly taken @koshea claimed this 9 days ago. Open
Difficulty 4/5 3-5 days Newbie friendliness 30/100
Maintainers usually reply within 1 day
-
Receive flow-control stall after SETTINGS ACK shrinks the window with previously released capacityOpen
Difficulty 3/5 1-2 days Newbie friendliness 50/100
hyperium/h2#976 · 1 reaction ·
Maintainers usually reply within 1 day
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
Maintainers usually reply within 3 days
-
[BUG] Filename sequence expansion (`+`) panics on numeric values exceeding `i32::MAX`Possibly taken @muntasir-396 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
CCExtractor/ccextractor#2402 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 70/100