From 3276b8794eb56752fbde987deb4039ba2a54c480 Mon Sep 17 00:00:00 2001
From: Matthew Pomes <the10thwiz@gmail.com>
Date: Fri, 21 May 2021 23:07:36 -0700
Subject: [PATCH] Remove use of unsafe in 'parse_owned()'.

This fixes a soundness issue where a returned error may refer to a
long-lived borrow and removes the potential for any such infraction in
the future.
---
 core/http/src/uri/origin.rs | 49 ++++++++++++-------------------------
 1 file changed, 15 insertions(+), 34 deletions(-)

diff --git a/core/http/src/uri/origin.rs b/core/http/src/uri/origin.rs
index 2abb971fdd..7678e1a0d7 100644
--- a/core/http/src/uri/origin.rs
+++ b/core/http/src/uri/origin.rs
@@ -177,10 +177,12 @@ impl<'a> Origin<'a> {
         ::parse::uri::route_origin_from_str(string)
     }
 
-    /// Parses the string `string` into an `Origin`. Parsing will never
-    /// allocate. This method should be used instead of
-    /// [`Origin::parse()`](uri::Origin::parse()) when the source URI is already
-    /// a `String`. Returns an `Error` if `string` is not a valid origin URI.
+    /// Parses the string `string` into an `Origin`. Parsing will never allocate
+    /// on success. May allocate on error.
+    ///
+    /// This method should be used instead of [`Origin::parse()`](Self::parse())
+    /// when the source URI is already a `String`. Returns an `Error` if
+    /// `string` is not a valid origin URI.
     ///
     /// # Example
     ///
@@ -194,36 +196,15 @@ impl<'a> Origin<'a> {
     /// assert_eq!(uri.query(), None);
     /// ```
     pub fn parse_owned(string: String) -> Result<Origin<'static>, Error<'static>> {
-        // We create a copy of a pointer to `string` to escape the borrow
-        // checker. This is so that we can "move out of the borrow" later.
-        //
-        // For this to be correct and safe, we need to ensure that:
-        //
-        //  1. No `&mut` references to `string` are created after this line.
-        //  2. `string` isn't dropped by `copy_of_str` is live.
-        //
-        // These two facts can be easily verified. An `&mut` can be created
-        // because `string` isn't `mut`. Then, `string` is clearly not dropped
-        // since it's passed in to `source`.
-        let copy_of_str = unsafe { &*(string.as_str() as *const str) };
-        let origin = Origin::parse(copy_of_str)?;
-
-        let uri = match origin {
-            Origin { source: Some(_), path, query, segment_count } => Origin {
-                segment_count,
-                path: path.into_owned(),
-                query: query.into_owned(),
-                // At this point, it's impossible for anything to be borrowing
-                // `string` except for `source`, even though Rust doesn't know
-                // it. Because we're replacing `source` here, there can't
-                // possibly be a borrow remaining, it's safe to "move out of the
-                // borrow".
-                source: Some(Cow::Owned(string)),
-            },
-            _ => unreachable!("parser always parses with a source")
-        };
-
-        Ok(uri)
+        let origin = Origin::parse(&string).map_err(|e| e.into_owned())?;
+        debug_assert!(origin.source.is_some(), "Origin source parsed w/o source");
+
+        Ok(Origin {
+            path: origin.path.into_owned(),
+            query: origin.query.into_owned(),
+            segment_count: origin.segment_count,
+            source: Some(Cow::Owned(string))
+        })
     }
 
     /// Returns `true` if `self` is normalized. Otherwise, returns `false`.