wasmtime / PR #14123 fix(wasi-http): validate ports in p2... · git-wasmtime

Stream: git-wasmtime

Topic: wasmtime / PR #14123 fix(wasi-http): validate ports in p2...

Wasmtime GitHub notifications bot (Aug 12 2026 at 02:22):

SashaMIT opened PR #14123 from SashaMIT:fix/wasi-http-p2-authority-port-validation to bytecodealliance:main:

Summary

Align WASIp2 OutgoingRequest::set_authority with the existing WASIp3 parse_authority check so empty, non-numeric, and out-of-range ports are rejected.

Share that helper at crate scope (authority.rs) so p2 and p3 cannot drift.

Extend unit coverage (example.com:65536, [::1]:abc).

http::uri::Authority accepts authorities such as example.com: and example.com:abc. p3 already rejects those (#13739 class). p2 did not. With a bad authority, default_send_request sees no numeric port and appends the scheme default, producing broken connect targets such as example.com::443 / example.com:abc:443.

Threat model: guest-controlled wasi-http authority string on the host outbound connect / TLS path. Fail closed before host I/O, matching p3.

Test plan

[x] cargo test -p wasmtime-wasi-http --lib authority_accepts --features 'p2,p3'

[x] Revert-tested: removing the port_u16 reject makes the new cases fail

Made with Cursor