Title: Panic in trace! call due to unwrap() on non-UTF-8 bytes in protocols/http/v1/client.rs:818 #1023

Hello,

We experienced an outage across all our production services utilizing Pingora, caused by yet another unhandled .unwrap() within the Pingora codebase. Unfortunately, the library relies heavily on .unwrap(), which poses significant reliability risks and makes it ill-suited for critical production environments. Following our investigation, here is the root cause :

Describe the bug

​Under heavy load, when an upstream backend returns response headers or status containing non-UTF-8 bytes (e.g. ISO-8859-1/Latin-1 characters or binary payload residues), the Pingora HTTP proxy service panics and crashes with SIGABRT (status=6/ABRT).

​Even when the active logging level is set to INFO, the panic still triggers because Rust evaluates macro arguments eagerly before evaluating log level filters.

​Log Output

​2026-09-28T08:03:24.279410Z ERROR panic: called Result::unwrap() on an Err value: Utf8Error { valid_up_to: 218, error_len: Some(1) }
2026-09-28T08:03:24.279557Z ERROR location: pingora-core/src/protocols/http/v1/client.rs:818
thread 'Pingora HTTP Proxy Service' panicked at pingora-core/src/protocols/http/v1/client.rs:818:56:
called Result::unwrap() on an Err value: Utf8Error { valid_up_to: 218, error_len: Some(1) }
xxx.service: Main process exited, code=killed, status=6/ABRT
xxx.service: Failed with result 'signal'.

Root Cause

​At line 818 of pingora-core/src/protocols/http/v1/client.rs, a trace! statement converts raw response bytes using std::str::from_utf8(...).unwrap().

 pub async fn read_response_task(&mut self) -> Result<HttpTask> {
        if self.should_read_resp_header() {
            let resp_header = self.read_resp_header_parts().await?;
            let end_of_body = self.is_body_done();
            debug!("Response header: {resp_header:?}");
            trace!(
                "Raw Response header: {:?}",
                str::from_utf8(self.get_headers_raw()).unwrap()
            );
            Ok(HttpTask::Header(resp_header, end_of_body))
        } else if self.is_body_done() {
            // no body
            debug!("Response is done");
            Ok(HttpTask::Done)
        } else {
            /* need to read body */
            let body = self.read_body_bytes().await?;
            let end_of_body = self.is_body_done();
            debug!(
                "Response body: {} bytes, end: {end_of_body}",
                body.as_ref().map_or(0, |b| b.len())
            );
            trace!("Response body: {body:?}, upgraded: {}", self.upgraded);
            if self.upgraded {
                Ok(HttpTask::UpgradedBody(body, end_of_body))
            } else {
                Ok(HttpTask::Body(body, end_of_body))
            }
        }
        // TODO: support h1 trailer
    }

​Unsafe unwrap on external network input: Upstream server responses cannot be guaranteed to be 100% valid UTF-8 (especially under edge cases, error conditions, or legacy ISO-8859-1 encodings).
​Eager argument evaluation: Because from_utf8(...).unwrap() is passed as an argument directly into trace!, the expression evaluates before the logger checks whether TRACE level is enabled. As a result, production services running at INFO level still suffer the panic and abort.
​

Suggested Fix

​Use String::from_utf8_lossy instead of .unwrap() in tracing/logging calls, or wrap the log statement behind an explicit log_enabled! guard:

​trace!("...", String::from_utf8_lossy(&bytes));

​Alternatively:

​if log::log_enabled!(log::Level::Trace) {
if let Ok(s) = std::str::from_utf8(&bytes) {
trace!("...", s);
}
}