fix(confidential-http): sanitize response headers to valid UTF-8#18
Merged
Conversation
HTTP header names and values may contain arbitrary bytes, but the proto HeaderValues fields are strings and must be valid UTF-8 to be marshaled over gRPC. When an upstream server returned a header with invalid UTF-8, the StandardCapabilities client failed to marshal the response with: grpc: error while marshaling: string field contains invalid UTF-8 convertHeaders now sanitizes header names and values, replacing invalid bytes with U+FFFD while leaving already-valid strings untouched. Adds unit tests covering preservation of valid UTF-8, sanitization of invalid bytes, and that the resulting Response marshals successfully. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
👋 prashantkumar1982, thanks for creating this pull request! To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team. Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks! |
vreff
approved these changes
Jul 23, 2026
cfal
approved these changes
Jul 23, 2026
vreff
added a commit
that referenced
this pull request
Jul 23, 2026
…ader-utf8-sanitize fix(confidential-http): sanitize response headers to valid UTF-8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
confidential-httpStandardCapability failed to return responses whenever an upstream server sent an HTTP header containing non-UTF-8 bytes. The gRPC marshaler (which validates that protostringfields are valid UTF-8) rejected the response, surfacing as:Response headers are populated directly from Go's
http.Header, whose names and values may contain arbitrary bytes. These land in the protostringfields ofHeaderValues(enclave/apps/confidential-http/app/app.go), so any invalid UTF-8 broke marshaling of the entire capability response. (The response body isbytesand was unaffected.)Fix
convertHeadersnow sanitizes header names and values via a newsanitizeUTF8helper, which replaces invalid bytes with the Unicode replacement character (U+FFFD) and returns already-valid strings unchanged (zero-cost in the common case).Tests
TestConvertHeaders_PreservesValidUTF8— valid names/values (incl. multi-byte UTF-8) pass through untouched.TestConvertHeaders_SanitizesInvalidUTF8— invalid bytes in names/values are sanitized, valid siblings untouched, and the resultingResponsenowproto.Marshals without error.TestSanitizeUTF8_ReturnsValidStringUnchanged— helper returns valid inputs identically.All pass locally.
Note
The same bug exists in the mirror
confidential-computerepo; this PR fixes onlychainlink-confidential-computeper request.🤖 Generated with Claude Code