-
Notifications
You must be signed in to change notification settings - Fork 43
Description
Description:
Consumers of ResponseChain methods (HeadersString() and BodyString()) may experience data corruption where string values change unexpectedly after the ResponseChain is closed.
Root cause:
The methods used conversion.String() to perform a zero-copy conversion of the underlying byte buffer.
Since ResponseChain uses a buffer pool, the memory backing these strings is returned to the pool upon Close(). When that memory is reused by a subsequent request, the original string values, which are still pointing to that memory, are overwritten.
Impact:
This causes race conditions where data read from a previous response can be mutated by a new response, leading to UB and corrupted data in downstream processing.
Additional context:
See failed tests in Nuclei: https://github.com/projectdiscovery/nuclei/actions/runs/19770495075/job/56654276664?pr=6629.