Stream: git-wasmtime

Topic: wasmtime / PR #14747 reject userinfo in wasi-http request...

view this post on Zulip Wasmtime GitHub notifications bot (Oct 14 2026 at 18:18):

netliomax25-code opened PR #14747 from netliomax25-code:wasi-http-authority-userinfo to bytecodealliance:main:

  1. request.set-authority accepted an RFC 3986 userinfo subcomponent such as user@example.com: the http crate's Authority parses it, and the shared parse_authority helper only validated the port.
  2. Both the p2 and p3 outgoing request paths emit the authority verbatim as the Host header, which guests cannot set directly because host is a forbidden header, and RFC 9110 defines Host as uri-host [":" port] and forbids a sender from generating userinfo within a message.

An @ can only occur in an authority as the userinfo delimiter, and percent-encoded forms are already rejected by the http crate, so parse_authority now rejects any authority containing one. Unit tests cover the rejected forms, and the p2/p3 guest test programs assert set-authority fails for them.

view this post on Zulip Wasmtime GitHub notifications bot (Oct 14 2026 at 18:18):

netliomax25-code requested rvolosatovs for a review on PR #14747.

view this post on Zulip Wasmtime GitHub notifications bot (Oct 14 2026 at 18:18):

netliomax25-code requested wasmtime-wasi-reviewers for a review on PR #14747.

view this post on Zulip Wasmtime GitHub notifications bot (Oct 14 2026 at 18:18):

netliomax25-code requested alexcrichton for a review on PR #14747.

view this post on Zulip Wasmtime GitHub notifications bot (Oct 14 2026 at 18:18):

netliomax25-code requested wasmtime-core-reviewers for a review on PR #14747.

view this post on Zulip Wasmtime GitHub notifications bot (Oct 14 2026 at 18:54):

alexcrichton unassigned alexcrichton from PR #14747 reject userinfo in wasi-http request authorities.

view this post on Zulip Wasmtime GitHub notifications bot (Oct 14 2026 at 18:54):

alexcrichton requested pchickey for a review on PR #14747.

view this post on Zulip Wasmtime GitHub notifications bot (Oct 21 2026 at 17:02):

:thumbs_up: rvolosatovs submitted PR review.

view this post on Zulip Wasmtime GitHub notifications bot (Oct 21 2026 at 17:02):

rvolosatovs added PR #14747 reject userinfo in wasi-http request authorities to the merge queue.

view this post on Zulip Wasmtime GitHub notifications bot (Oct 21 2026 at 17:24):

:check: rvolosatovs merged PR #14747.

view this post on Zulip Wasmtime GitHub notifications bot (Oct 21 2026 at 17:24):

rvolosatovs removed PR #14747 reject userinfo in wasi-http request authorities from the merge queue.

Last updated: Oct 31 2026 at 23:03 UTC