Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Version 6.3.3 #3307

Merged
merged 4 commits into from
Aug 11, 2023
Merged

Version 6.3.3 #3307

merged 4 commits into from
Aug 11, 2023

Commits on Aug 11, 2023

  1. http1connection: Make content-length parsing more strict 

    Content-length and chunk size parsing now strictly matches the RFCs.
We previously used the python int() function which accepted leading
plus signs and internal underscores, which are not allowed by the
HTTP RFCs (it also accepts minus signs, but these are less problematic
in this context since they'd result in errors elsewhere)

It is important to fix this because when combined with certain proxies,
the lax parsing could result in a request smuggling vulnerability (if
both Tornado and the proxy accepted an invalid content-length but
interpreted it differently). This is known to occur with old versions
of haproxy, although the current version of haproxy is unaffected.
    @bdarnell
    bdarnell committed Aug 11, 2023
    Configuration menu
    Copy the full SHA
    217295b View commit details
    Browse the repository at this point in the history

  2. httpserver_test: Add ExpectLog to fix CI 

    The github security advisory feature lets you make private PRs but
it apparently doesn't support CI so this log failure wasn't caught
until after the PR was merged.
    @bdarnell
    bdarnell committed Aug 11, 2023
    Configuration menu
    Copy the full SHA
    7dfe8b5 View commit details
    Browse the repository at this point in the history

  3. Set version to 6.3.3

    @bdarnell
    bdarnell committed Aug 11, 2023
    Configuration menu
    Copy the full SHA
    5c8a9a4 View commit details
    Browse the repository at this point in the history

  4. ci: Don't test py312 in branch6.3

    @bdarnell
    bdarnell committed Aug 11, 2023
    Configuration menu
    Copy the full SHA
    6a9e6fb View commit details
    Browse the repository at this point in the history