prometheus/util/httputil/compression_test.go
jub0bs 329ec6831a
util/httputil: reduce heap allocations in newCompressedResponseWriter (#16001)
* util/httputil: Benchmark newCompressedResponseWriter

This benchmark illustrates that newCompressedResponseWriter incurs a
prohibitive amount of heap allocations when handling a request containing a
malicious Accept-Encoding header.¬

Signed-off-by: jub0bs <jcretel-infosec+github@protonmail.com>

* util/httputil: Improve newCompressedResponseWriter

This change dramatically reduces the heap allocations (in bytes)
incurred when handling a request containing a malicious Accept-Encoding header.

Below are some benchmark results; for conciseness, I've omitted the name of the
benchmark function (BenchmarkNewCompressionHandler_MaliciousAcceptEncoding):

```
goos: darwin
goarch: amd64
pkg: github.com/prometheus/prometheus/util/httputil
cpu: Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz
│     old     │                 new                 │
│   sec/op    │   sec/op     vs base                │
  18.60m ± 2%   13.54m ± 3%  -27.17% (p=0.000 n=10)

│       old        │                 new                 │
│       B/op       │    B/op     vs base                 │
  16785442.50 ± 0%   32.00 ± 0%  -100.00% (p=0.000 n=10)

│    old     │                new                 │
│ allocs/op  │ allocs/op   vs base                │
  2.000 ± 0%   1.000 ± 0%  -50.00% (p=0.000 n=10)
```

Signed-off-by: jub0bs <jcretel-infosec+github@protonmail.com>

---------

Signed-off-by: jub0bs <jcretel-infosec+github@protonmail.com>
2025-02-11 14:14:55 +01:00

156 lines
4.2 KiB
Go

// Copyright 2016 The Prometheus Authors
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package httputil
import (
"bytes"
"io"
"net/http"
"net/http/httptest"
"strings"
"testing"
"github.com/klauspost/compress/gzip"
"github.com/klauspost/compress/zlib"
"github.com/stretchr/testify/require"
)
var (
mux *http.ServeMux
server *httptest.Server
)
func setup() func() {
mux = http.NewServeMux()
server = httptest.NewServer(mux)
return func() {
server.Close()
}
}
func getCompressionHandlerFunc() CompressionHandler {
hf := func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusOK)
w.Write([]byte("Hello World!"))
}
return CompressionHandler{
Handler: http.HandlerFunc(hf),
}
}
func TestCompressionHandler_PlainText(t *testing.T) {
tearDown := setup()
defer tearDown()
ch := getCompressionHandlerFunc()
mux.Handle("/foo_endpoint", ch)
client := &http.Client{
Transport: &http.Transport{
DisableCompression: true,
},
}
resp, err := client.Get(server.URL + "/foo_endpoint")
require.NoError(t, err, "client get failed with unexpected error")
defer resp.Body.Close()
contents, err := io.ReadAll(resp.Body)
require.NoError(t, err, "unexpected error while creating the response body reader")
expected := "Hello World!"
actual := string(contents)
require.Equal(t, expected, actual, "expected response with content")
}
func BenchmarkNewCompressionHandler_MaliciousAcceptEncoding(b *testing.B) {
rec := httptest.NewRecorder()
req := httptest.NewRequest(http.MethodGet, "/whatever", nil)
req.Header.Set("Accept-Encoding", strings.Repeat(",", http.DefaultMaxHeaderBytes))
b.ReportAllocs()
b.ResetTimer()
for range b.N {
newCompressedResponseWriter(rec, req)
}
}
func TestCompressionHandler_Gzip(t *testing.T) {
tearDown := setup()
defer tearDown()
ch := getCompressionHandlerFunc()
mux.Handle("/foo_endpoint", ch)
client := &http.Client{
Transport: &http.Transport{
DisableCompression: true,
},
}
req, _ := http.NewRequest(http.MethodGet, server.URL+"/foo_endpoint", nil)
req.Header.Set(acceptEncodingHeader, gzipEncoding)
resp, err := client.Do(req)
require.NoError(t, err, "client get failed with unexpected error")
defer resp.Body.Close()
actualHeader := resp.Header.Get(contentEncodingHeader)
require.Equal(t, gzipEncoding, actualHeader, "unexpected encoding header in response")
var buf bytes.Buffer
zr, err := gzip.NewReader(resp.Body)
require.NoError(t, err, "unexpected error while creating the response body reader")
_, err = buf.ReadFrom(zr)
require.NoError(t, err, "unexpected error while reading the response body")
actual := buf.String()
expected := "Hello World!"
require.Equal(t, expected, actual, "unexpected response content")
}
func TestCompressionHandler_Deflate(t *testing.T) {
tearDown := setup()
defer tearDown()
ch := getCompressionHandlerFunc()
mux.Handle("/foo_endpoint", ch)
client := &http.Client{
Transport: &http.Transport{
DisableCompression: true,
},
}
req, _ := http.NewRequest(http.MethodGet, server.URL+"/foo_endpoint", nil)
req.Header.Set(acceptEncodingHeader, deflateEncoding)
resp, err := client.Do(req)
require.NoError(t, err, "client get failed with unexpected error")
defer resp.Body.Close()
actualHeader := resp.Header.Get(contentEncodingHeader)
require.Equal(t, deflateEncoding, actualHeader, "expected response with encoding header")
var buf bytes.Buffer
dr, err := zlib.NewReader(resp.Body)
require.NoError(t, err, "unexpected error while creating the response body reader")
_, err = buf.ReadFrom(dr)
require.NoError(t, err, "unexpected error while reading the response body")
actual := buf.String()
expected := "Hello World!"
require.Equal(t, expected, actual, "expected response with content")
}