![]() Motivation: http-parser shipped a patche for node.js CVE-2019-15605, which allowed HTTP request smuggling. This affected SwiftNIO as well, and so we need to immediately ship an update to help protect affected users. A CVE for SwiftNIO will follow, but as this patch is in the wild and SwiftNIO is known to be affected we should not delay shipping this fix. Modifications: - Update http-parser. - Add regression tests to validate this behaviour. Result: Close request smugging vector. |
||
---|---|---|
.. | ||
ByteCollectionUtils.swift | ||
HTTPDecoder.swift | ||
HTTPEncoder.swift | ||
HTTPPipelineSetup.swift | ||
HTTPServerPipelineHandler.swift | ||
HTTPServerProtocolErrorHandler.swift | ||
HTTPServerUpgradeHandler.swift | ||
HTTPTypes.swift | ||
NIOHTTPClientUpgradeHandler.swift |