Mirror of git.openembedded.org/meta-openembedded https://git.enea.com/cgit/linux/meta-openembedded.git/atom?h=whinlatter 2024-08-28T14:11:34+00:00 2024-08-28T14:11:34+00:00 Wang Mingyu wangmy@fujitsu.com 2024-08-28T08:25:02+00:00 urn:sha1:f96f5cef7a71bf395a46a22be32317ba7104c424 Changelog: =========== - minor docs fixes - worker_class parameter accepts a class - fix deadlock if request terminated during chunked parsing - permit receiving Transfer-Encodings: compress, deflate, gzip - permit Transfer-Encoding headers specifying multiple encodings. note: no parameters, still - sdist generation now explicitly excludes sphinx build folder - decode bytes-typed status (as can be passed by gevent) as utf-8 instead of raising TypeError - raise correct Exception when encounting invalid chunked requests - the SCRIPT_NAME and PATH_INFO headers, when received from allowed forwarders, are no longer restricted for containing an underscore - include IPv6 loopback address [::1] in default for forwarded_allow_ips and proxy_allow_ips - refuse requests where the uri field is empty - refuse requests with invalid CR/LR/NUL in heade field values - remove temporary --tolerate-dangerous-framing switch from 22.0 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2024-06-22T04:45:11+00:00 Leon Anavi leon.anavi@konsulko.com 2024-06-21T11:34:59+00:00 urn:sha1:6fe1441f128470f4947b1d4ec8c955ce49b3742b - use utime to notify workers liveness - migrate setup to pyproject.toml - fix numerous security vulnerabilities in HTTP parser (closing some request smuggling vectors) - parsing additional requests is no longer attempted past unsupported request framing - on HTTP versions < 1.1 support for chunked transfer is refused (only used in exploits) - requests conflicting configured or passed SCRIPT_NAME now produce a verbose error - Trailer fields are no longer inspected for headers indicating secure scheme - support Python 3.12 License-Update: Update license year Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>