header_rewrite: reject a modifier-only config line - #13650
Open
bneradt wants to merge 1 commit into
Open
Conversation
bneradt
added
Plugins
header_rewrite
A header_rewrite configuration line consisting of nothing but a modifier section, such as a stray "[L]", crashes Traffic Server at config load time. The parser consumes the trailing modifiers with a pop_back() and then indexes tokens[0] unconditionally, so an empty token list is read out of bounds. On a hardened build that aborts during plugin init, which takes the whole server down; elsewhere it is a read of a destroyed std::string. Any operator who can write a header_rewrite config can trigger it. This patch guards the token list after the modifier section is consumed. A line with no condition or operator left is not a valid rule, so the parser now reports the offending modifiers with TSError and returns false, which the existing caller already handles by logging the line number and skipping the line. The rest of the config loads normally. This change also adds a unit test covering both a short, small-string optimized modifier token and a longer heap allocated one, plus an end-to-end autest that loads such a config and verifies that Traffic Server starts, logs the rejection, and still applies the surrounding rules. Fixes: apache#13639 Co-authored-by: Claude Opus 5
bneradt
force-pushed
the
header-rewrite-modifier-only-line
branch
from
September 8, 2026 20:35
3e0e16d to
8795a45
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A header_rewrite configuration line consisting of nothing but a
modifier section, such as a stray "[L]", crashes Traffic Server at
config load time. The parser consumes the trailing modifiers with a
pop_back() and then indexes tokens[0] unconditionally, so an empty
token list is read out of bounds. On a hardened build that aborts
during plugin init, which takes the whole server down; elsewhere it is
a read of a destroyed std::string. Any operator who can write a
header_rewrite config can trigger it.
This patch guards the token list after the modifier section is
consumed. A line with no condition or operator left is not a valid
rule, so the parser now reports the offending modifiers with TSError
and returns false, which the existing caller already handles by
logging the line number and skipping the line. The rest of the config
loads normally.
This change also adds a unit test covering both a short, small-string
optimized modifier token and a longer heap allocated one, plus an
end-to-end autest that loads such a config and verifies that Traffic
Server starts, logs the rejection, and still applies the surrounding
rules.
Fixes: #13639
Co-authored-by: Claude Opus 5