-
Notifications
You must be signed in to change notification settings - Fork 135
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
RUM-3183 Remove usage of unsafe
request.allHTTPHeaderFields
As observed in #1638, accessing `request.allHTTPHeaderFields` is not safe and leads to crashes with undefined root cause. To avoid this, instead we use `request.value(forHTTPHeaderField:)` to only read headers known by the SDK.
- Loading branch information
Showing
6 changed files
with
104 additions
and
25 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
44 changes: 44 additions & 0 deletions
44
DatadogInternal/Sources/NetworkInstrumentation/URLSession/ImmutableRequest.swift
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| /* | ||
| * Unless explicitly stated otherwise all files in this repository are licensed under the Apache License Version 2.0. | ||
| * This product includes software developed at Datadog (https://www.datadoghq.com/). | ||
| * Copyright 2019-Present Datadog, Inc. | ||
| */ | ||
|
|
||
| import Foundation | ||
|
|
||
| /// An immutable version of `URLRequest`. | ||
| /// | ||
| /// Introduced in response to concerns raised in https://github.com/DataDog/dd-sdk-ios/issues/1638 | ||
| /// it makes a copy of request attributes, safeguarding against potential thread safety issues arising from concurrent | ||
| /// mutations (see more context in https://github.com/DataDog/dd-sdk-ios/pull/1767 ). | ||
| public struct ImmutableRequest { | ||
| /// The URL of the request. | ||
| public let url: URL? | ||
| /// The HTTP method of the request. | ||
| public let httpMethod: String? | ||
| /// Known HTTP header fields of the request. | ||
| public let knownHTTPHeaderFields: [String: String] | ||
| /// A reference to the original `URLRequest` object provided during initialization. Direct use is discouraged | ||
| /// due to thread safety concerns. Instead, necessary attributes should be accessed through `ImmutableRequest` fields. | ||
| public let unsafeOriginal: URLRequest | ||
|
|
||
| public init(request: URLRequest) { | ||
| self.url = request.url | ||
| self.httpMethod = request.httpMethod | ||
|
|
||
| // As observed in https://github.com/DataDog/dd-sdk-ios/issues/1638, accessing `request.allHTTPHeaderFields` is not | ||
| // safe and leads to crashes with undefined root cause. To avoid this, instead we use `request.value(forHTTPHeaderField:)` | ||
| // to only read headers known by the SDK. | ||
| var knownHTTPHeaderFields: [String: String] = [:] | ||
| addHeaderIfExists(request: request, field: TracingHTTPHeaders.originField, to: &knownHTTPHeaderFields) | ||
|
|
||
| self.knownHTTPHeaderFields = knownHTTPHeaderFields | ||
| self.unsafeOriginal = request | ||
| } | ||
| } | ||
|
|
||
| private func addHeaderIfExists(request: URLRequest, field: String, to knownHeaders: inout [String: String]) { | ||
| if let value = request.value(forHTTPHeaderField: field) { | ||
| knownHeaders[field] = value | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
45 changes: 45 additions & 0 deletions
45
DatadogInternal/Tests/NetworkInstrumentation/ImmutableRequestTests.swift
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| /* | ||
| * Unless explicitly stated otherwise all files in this repository are licensed under the Apache License Version 2.0. | ||
| * This product includes software developed at Datadog (https://www.datadoghq.com/). | ||
| * Copyright 2019-Present Datadog, Inc. | ||
| */ | ||
|
|
||
| import XCTest | ||
| import TestUtilities | ||
| import DatadogInternal | ||
|
|
||
| class ImmutableRequestTests: XCTestCase { | ||
| func testReadingURL() { | ||
| let original: URLRequest = .mockWith(url: "https://example.com") | ||
| let immutable = ImmutableRequest(request: original) | ||
| XCTAssertEqual(immutable.url, original.url) | ||
| } | ||
|
|
||
| func testReadingHTTPMethod() { | ||
| let original: URLRequest = .mockWith(httpMethod: .mockRandom()) | ||
| let immutable = ImmutableRequest(request: original) | ||
| XCTAssertEqual(immutable.httpMethod, original.httpMethod) | ||
| } | ||
|
|
||
| func testReadingKnownHeaders() { | ||
| let original: URLRequest = .mockWith( | ||
| headers: [ | ||
| TracingHTTPHeaders.originField: .mockRandom(length: 128), | ||
| ] | ||
| ) | ||
| let immutable = ImmutableRequest(request: original) | ||
| XCTAssertEqual(immutable.knownHTTPHeaderFields[TracingHTTPHeaders.originField], original.allHTTPHeaderFields?[TracingHTTPHeaders.originField]) | ||
| } | ||
|
|
||
| func testIgnoringUnknownHeaders() { | ||
| let original: URLRequest = .mockWith(headers: .mockRandom()) | ||
| let immutable = ImmutableRequest(request: original) | ||
| XCTAssertTrue(immutable.knownHTTPHeaderFields.isEmpty) | ||
| } | ||
|
|
||
| func testPreservingUnsafeOriginal() { | ||
| let original: URLRequest = .mockAny() | ||
| let immutable = ImmutableRequest(request: original) | ||
| XCTAssertEqual(immutable.unsafeOriginal, original) | ||
| } | ||
| } |