这是indexloc提供的服务,不要输入任何密码
Skip to content

Audit httparse #73

@Shnatsel

Description

@Shnatsel

https://crates.io/crates/httparse is a widely used HTTP parsing crate, most notably powering hyper and reqwest.

cargo-geiger shows the following when httparse is used via reqwest:

Functions  Expressions  Impls  Traits  Methods  Dependency
10/10      198/232      0/0    0/0     3/3      httparse 1.3.5

Unsafe code in parsers it quite dangerous. Binary format parsers are the poster children for memory safety vulnerabilities.

Text format parsers are a bit less dangerous, but having so much unsafe parsing code exposed to untrusted input is still scary.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions