Hostile ^92% rust 53 installs Download

abyss-mitm 1.0.2

TLS interception and MITM

“TLS interception and HTTP stream handling for the Abyss runtime”

Duplicate Content-Length desync probe in sourceDuplicate Content-Length headers in source

SHA-256e4805cc672e1cf818e2ee4db7f7cc1a3a90c2e32ede93a7f886ce52149954e50

URLhttps://static.crates.io/crates/abyss-mitm/abyss-mitm-1.0.2.crate

MaleculeK₂(LiTe)O₂(Xe₂As)H₇(Cm₂₀Cr₂Db₅F₈MgOs₂Po₃)Md₂(In₈₃Pa₃)

Evidence

imports http::uri::Authority lines 1–21

1//! Explicit HTTP proxy request decoding and normalization.
2//!
3//! The broker listener owns accepted sockets, target resolution, and proxy
4//! responses. This module only consumes the first bounded HTTP/1.1 request head,
5//! validates explicit-proxy semantics, and returns the target plus bytes that
6//! must be replayed into the shared MITM pipeline. `CONNECT` payload bytes are
7//! preserved unchanged, while absolute-form HTTP requests are rewritten to
8//! origin form and stripped of proxy-only credentials and headers.
9
10use std::{fmt, io, net::IpAddr, str, time::Duration};
11
12use http::{Uri, uri::Authority};
13use thiserror::Error;
14use tokio::{
15    io::{AsyncRead, AsyncReadExt as _},
16    time,
17};
18
19const HEADER_READ_CHUNK_BYTES: usize = 1024;
20const MAX_EXPLICIT_PROXY_HEADERS: usize = 64;
21const  …

Contains an unbounded block loop lines 361–364

34… h_capacity(HEADER_READ_CHUNK_BYTES.min(self.max_header_bytes));
      loop {
          // Stop as soon as the HTTP head terminator is present. Any bytes
          // after it are preserved so the MITM …

Network destination assigned from call lines 545–552

545:17… rr(invalid_target(raw, "port must not be zero"));
546    }
547    let host =
548        normalize_target_host(authority.host()).map_err(|reason| invalid_target(raw, reason))?;
549    Ok(TargetAuthority { host, port })
550}
551
552/// Normalizes the h …

Multiple standard HTTP request lines in source lines 973–986

  async fn rejects_ambiguous_absolute_http_framing() {
      let error = decode_once(
          concat!(
              "POST http://api.example.com/ HTTP/1.1\r\n",
              "Host: api.example.com\r\n",
              "Content-Length: 4\r\n",
              "Transfer-Encoding: chunked\r\n",
              "\r\n"
          )
⋯5 lines

Duplicate Content-Length headers in source lines 994–1009

16… cat!(
              "POST http://api.example.com/ HTTP/1.1\r\n",
              "Host: api.example.com\r\n",
              "Content-Length: 3\r\n",
              "Content-Length: 4\r\n",
              "\r\n"
          ),
          concat!(
              "POST http://api.example.com/ HTTP/1.1\r\n",
              "Host: api.example.com\r\n",
              "Transfer-Encoding: chunked, gzip\r\n",
⋯5 lines

Showing the top 5 files — 7 more files (68 regions) not shown.

No evidence locations were recorded for this file. Raw result