-
-
Notifications
You must be signed in to change notification settings - Fork 2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Please update llhttp to 9.2.1 #8291
Comments
@Dreamsorcerer I assume you would want to take a look at this. Please let me know if I can help with anything. |
Don't suppose you've got any time to investigate the regressions? |
Indeed, it seems like disabling obsolete line folding in headers by default was the essence of the CVE fix, nodejs/llhttp#348. I don’t think I have the necessary knowledge to evaluate the potential consequences of continuing to allow them in aiohttp, in lax mode or otherwise. |
OK, seeing their tests for it, I see what the issue is. We use lax for client-side, so request smuggling is generally not a concern, so will need to enable it for lax mode and adjust the tests if they are for server-side. |
OK, it already does what we want. I've updated the tests and updated the Python parser. You'll probably want to backport those changes to your packages. |
Thanks! I assume it will be a little while before 3.9.4 is ready, so I’ll plan to do just that (backport #8292 as a patch for 3.9.3). I appreciate your help in figuring out how to handle this change. |
Hopefully we'll have a release this weekend, been trying to get everything ready for a release anyway. |
Is your feature request related to a problem?
Version 9.2.1 of
llhttp
fixes CVE-2024-27982.Describe the solution you'd like
Update
llhttp
, similar to #8146.Examine the resulting regressions in the test suite – it looks like aiohttp may have been testing for and expecting the incorrect behavior, but I haven’t looked into it closely – and adjust as needed.
Describe alternatives you've considered
In the Fedora and EPEL9 packages, I will likely skip the tests with regressions in order to ship an updated
llhttp
package promptly.Related component
Server, Client
Additional context
Code of Conduct
The text was updated successfully, but these errors were encountered: