Backport #190 for 0.6.x #194
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
As identified in RUSTSEC-2020-0031, normalizing the value of a header field (through the use of `str::trim`) can make applications based on this library vulnerable to HTTP request smuggling if the immediate upstream load balancer interprets the malformed header in a different way. This backported patch based on a PR opened against master. [1] [1]: tiny-http#190 Co-authored-by: Ben Stern <bstern@fortian.com>
bradfier
changed the title
|
This backport released as 0.6.3. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a single commit backport of #190 by @therealbstern
Since a considerable number of consumers of
tiny-httpwill be using Rouille, which currently targets0.6.2, it would be nice to have this patch released as a0.6.3version so that users pick it up automatically when they runcargo update.GitHub won't let me express that, so please feel free to retarget this PR at a branch off the 0.6.2 tag, it should apply cleanly.