Currently Envoy does not limit which headers can be modified from Wasm plugins, so if a plugin removes, for example, :status header from the response headers, then Envoy crashes. Ideally, we should verify the final headers in the Wasm plugin in Envoy. In any way, Envoy should not crash even when the processed headers from filters are invalid in terms of the "contents".

This is a potential security risk when we start running untrusted Wasm binaries. I think this might not be a Wasm specific issue, but rather a generic point we can improve to make Envoy protected against a crash path.

I guess there's already a similar GH issue, but I couldn't find. Thanks!

cc @PiotrSikora @lizan