Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rpc: remove HTTP proxy support #1346

Closed
wants to merge 1 commit into from
Closed

Conversation

mzabaluev
Copy link
Contributor

Closes #1342 by removing all use of hyper-proxy, and the HTTP proxy support in tendermint-rpc client which requires it.

  • Referenced an issue explaining the need for the change
  • Updated all relevant documentation in docs
  • Updated all code comments where relevant
  • Wrote tests
  • Added entry in .changelog/

To remediate RUSTSEC-2023-0052 with hyper-proxy being unmaintained,
cut out all support for HTTP proxies.
@thanethomson
Copy link
Contributor

@tony-iqlusion, IIRC you needed HTTP proxy support, which drove the work in #820 right?

@tony-iqlusion
Copy link
Collaborator

Yes, though it seems hyper-proxy may be unmaintained, unfortunately.

@romac
Copy link
Member

romac commented Sep 5, 2023

How bad is that vulnerability in practice? I would expect that people will use proxies that they know and trust, and worst case that their VM running Hermes coming to a halt in case the proxy server is compromised to not have major consequences but I could be wrong. So perhaps before removing code that might be helpful to some of our users, although I am always partial to deleting code and tidying up dependencies, we should (a) assess the actual severity of the vulnerability for our use case and (b) see if we can wait it out a bit and push for the community to move to a better maintained alternative. What do you think @mzabaluev @tony-iqlusion @thanethomson?

@mzabaluev
Copy link
Contributor Author

@romac I have commented on the issue. Indeed the potential for exploiting this is quite limited. I've also started looking into implementing HTTP CONNECT transport on our own, which does not seem like a big thing to do (even though we need to set aside a day or two for this).

@mzabaluev
Copy link
Contributor Author

Let's preserve the functionality and go with #1362 instead.

@mzabaluev mzabaluev closed this Sep 28, 2023
@mzabaluev mzabaluev deleted the mikhail/cut-out-hyper-proxy branch September 28, 2023 17:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

RUSTSEC-2023-0052: webpki: CPU denial of service in certificate path building
4 participants