Update module github.com/valyala/fasthttp to v1.34.0 [SECURITY] - #5
Open
github-actions[bot] wants to merge 1 commit into
Open
Update module github.com/valyala/fasthttp to v1.34.0 [SECURITY]#5github-actions[bot] wants to merge 1 commit into
github-actions[bot] wants to merge 1 commit into
Conversation
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.19.0→v1.34.0Path traversal in github.com/valyala/fasthttp
CVE-2022-21221 / GHSA-fx95-883v-4q4h / GO-2022-0355 / SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866
More information
Details
The package github.com/valyala/fasthttp before 1.34.0 is vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. Note: This security issue impacts Windows users only.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Path traversal in github.com/valyala/fasthttp
CVE-2022-21221 / GHSA-fx95-883v-4q4h / GO-2022-0355 / SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866
More information
Details
The fasthttp.FS request handler is vulnerable to directory traversal attacks on Windows systems, and can serve files from outside the provided root directory.
URL path normalization does not handle Windows path separators (backslashes), permitting an attacker to construct requests with relative paths.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Release Notes
valyala/fasthttp (github.com/valyala/fasthttp)
v1.34.0Compare Source
59f94a3Update github.com/klauspost/compress (#1237) (Mikhail Faraponov)62c15a5Don't reset RequestCtx.s (#1234) (Erik Dubbelboer)7670c6eFix windows tests (#1235) (Erik Dubbelboer)f54ffa1feature: Keep the memory usage of the service at a stable level (#1216) (Rennbon)15262ecWarn about unsafe ServeFile usage (#1228) (Erik Dubbelboer)1116d03Fix panic while reading invalid trailers (Erik Dubbelboer)856ca8eUpdate dependencies (#1230) (Mikhail Faraponov)6b5bc7bAdd windows support to normalizePath (Erik Dubbelboer)f0b0cfeDon't log ErrBadTrailer by default (Erik Dubbelboer)6937feefix: (useless check), skip Response body if http method HEAD (#1224) (Pavel Burak)b85d2a2Fix http proxy behavior (#1221) (Aoang)ad8a07aRequestHeader support set no default ContentType (#1218) (Jack.Ju)c94581csupport configure HostClient (#1214) (lin longhjui)632e222Client examples (#1208) (Sergey Ponomarev)6a3cc23uri_test.go use example.com for clearness (#1212) (Sergey Ponomarev)9d665e0Update dependencies (#1204) (Mikhail Faraponov)8d7953eFix scheme check for not yet parsed requests (#1203) (ArminBTVS)v1.33.0Compare Source
61aa8b1remove redundant code (#1202) (tyltr)4369776fix(hijack): reuse RequestCtx (#1201) (Sergio VS)2aca3e8fix(hijack): reset userValues after hijack handler execution (#1199) (Sergio VS)9123060Updated dependencies (#1194) (Mikhail Faraponov)v1.32.0Compare Source
7eeb00eMake tests less flaky (#1189) (Erik Dubbelboer)d19b872Update tcpdialer.go (#1188) (Mikhail Faraponov)c727b99Release UseHostHeader in ReleaseRequest() (#1185) (Tolyar)6c0518bFix UseHostHeader for DoTimeout + tests (#1184) (Tolyar)6b55811Add MaxIdleWorkerDuration to Server. (#1183) (Kilos Liu)4517204Allow to set Host header for Client (#1169) (Tolyar)258a4c1fix: reset response after reset user values on keep-alive connections (#1176) (Sergio VS)e9db537Use %w to wrap errors (#1175) (Erik Dubbelboer)7db0597Fix bad request trailer panic (Erik Dubbelboer)4aadf9aFix parseTrailer panic (Erik Dubbelboer)da7ff7aAdd trailer support (#1165) (ichx)017f0aafix: reset request after reset user values on keep-alive connections (#1162) (Sergio VS)3b117f8feat: close idle connections when server shutdown (#1155) (ichx)a94a2c3Remove redundant code (#1154) (ichx)f7c354cFix race condition in Client.mCleaner (Erik Dubbelboer)c078a9dAdd string and bytes buffer convert trick in README (#1151) (ichx)3ff6aaauri: isHttps() and isHttp() (#1150) (Sergey Ponomarev)8febad0http.go: Request.SetURI() (Fix #1141) (#1148) (Sergey Ponomarev)2ca01c7fix: Status Line parsing and writing (#1135) (Shivansh Vij)931d0a4Fix lint (Erik Dubbelboer)d613502use sync.map is better (#1145) (halst)c15e642Don't run all race tests on windows (#1143) (Erik Dubbelboer)6006c87chore (#1137) (tyltr)6d4db9bFix race condition in getTCPAddrs (Erik Dubbelboer)528dd62feat: ability to read body separate from header (#1130) (Shivansh Vij)556aa81feat: ability to edit status messages (#1126) (Valentin Paz Marcolla)4cfec1afeat: make public Server.TLSConfig (#1128) (Sergio VS)fe7d90eremove redundant code (#1127) (tyltr)v1.31.0Compare Source
81fc968Add warning to readme (Erik Dubbelboer)7fdd526feat: a new userData APIRemove(#1117) (tyltr)f307299feat:no need to store nil (#1116) (tyltr)ad6d128URI.Parse should never change it's input (Erik Dubbelboer)ffab77aImprove return value reusability documentation (Erik Dubbelboer)542a203Properly parse URI (Erik Dubbelboer)711e421feat: improve TCPDialer bysync.mapinstead ofmap+mutex(#1106) (tyltr)adc0e57Remove useless runtime.KeepAlive (#1107) (Oleg Kovalov)44d0333fix: typo (#1105) (tyltr)06b464ffix typo in deadline (#1099) (Evgenii)46d9235Check go fmt during lint (#1097) (Erik Dubbelboer)v1.30.0Compare Source
713da4eAdding new compressible prefixes (#1092) (Kyle Unverferth)1647255remove unnecessary op (#1095) (tyltr)f0a2189feat: improve IsMethod (#1088) (tyltr)5d73da3Update status.go (#1093) (Mikhail Faraponov)3f70d78Some FS tests can't run in parallel (Erik Dubbelboer)ba40107compatible with new build tag (#1087) (tyltr)d9c7573improve invalidStatusLine by appending a[]bytedirectly (#1086) (tyltr)cad867aRemove the redundant badage (#1085) (Andy Pan)38992daFix []byte reuse bug (Erik Dubbelboer)6321103Various deadline fixes (#1081) (Erik Dubbelboer)51508d7Fix various Windows Github Action errors (#1082) (Erik Dubbelboer)c7ce95fFix s2b (#1079) (YenForYang)a50f59bIncrease various test timeouts (Erik Dubbelboer)0fe8cddOptimize size of Server by moving bool fields (#1077) (Lanco)a6f9c8aFix Client doc and mCleaner (#1076) (Erik Dubbelboer)5a6e6e1Add Go 1.17 support (#1074) (Erik Dubbelboer)v1.29.0Compare Source
97e1319Update compress (#1069) (Mikhail Faraponov)0263caeFix FasthttpSocksDialer example (Erik Dubbelboer)d31e6dbHandle perIPConn in RequestCtx.IsTLS() specially (#1064) (Tianyi Song)9466cd7fix typo: occured -> occurred (#1061) (Kazumasa Takenaka (Bamboo))b3ece39Update README.md (#1058) (Darío)d0df1e1Add ResetUserValues() and test (#1056) (Sujit Baniya)v1.28.0Compare Source
1504a84Increase TestHostClientMaxConnWaitTimeoutSuccess timeout (Erik Dubbelboer)f6560beFlush buffered responses if we have to wait for the next request (#1050) (Erik Dubbelboer)v1.27.0Compare Source
874c8caIncrease timeouts for Windows github actions (Erik Dubbelboer)924a63fIncrease TestServerTLSReadTimeout timeout (Erik Dubbelboer)410bde6Fix race condition in TestPipelineClientIssue832 (Erik Dubbelboer)9f2c636Lower go test time (Erik Dubbelboer)4ed933afix: set content-length properly when StreanRequestBody was enabled (#1049) (Meng)cec9953Add IdleTimeout to Shutdown documentation (Erik Dubbelboer)c12a061TCPDialer :: DNSCacheDuration option (#1046) (Ertuğrul Emre Ertekin)87fc958Run go test on github actions (#1047) (Erik Dubbelboer)be13b50Defined Transport for the client (#1045) (Darío)b8b065bDon't unwrap io.LimitedReader (Erik Dubbelboer)v1.26.0Compare Source
6233fbcFix header .Add functions (#1036) (Erik Dubbelboer)5bb5cfcRemove unused peekRawHeader (Erik Dubbelboer)7d13e18Add Request.TLS and try to avoid a new alloc if Request.Header is already allocated (#1034) (Sergio Andrés Virviescas Santana)b433ecfMake sure to reset the userValues always and at the exact time (#1027) (Sergio Andrés Virviescas Santana)a18c632Fix cookie panic (Erik Dubbelboer)f3e4118Don't recommend Go 1.13 (Erik Dubbelboer)v1.25.0Compare Source
fa3e5d8Run test with go 1.16.X (#1028) (Sergio Andrés Virviescas Santana)ffa0cabUse proper content-type when it is not present (#1023) (MoreFreeze)04cde74feature: add ConvertRequest func (#1024) (Nícolas Barbosa)5898006Upgrade dependencies and tidy (#1029) (Sergio Andrés Virviescas Santana)097fa05Fix ignoreBody still set content length (#1022) (MoreFreeze)b2f111bFix(adaptor): Fixed an issue where the adapter did not convert all (#1021) (Juan Chan)19fcd40Fix chunked streaming (#1015) (Roman Khimov)v1.24.0Compare Source
620f0c8Add option for middleware to set custom remote address (#1009) (Lauris BH)894272eFix golangci-lint action (#1010) (Lauris BH)v1.23.0Compare Source
2a6f7dbAdding support for securing error logs (#1001) (Daniel Firsht)e61c9d5Improve Client/HostClient pooling when many HostClient structs created and removed during program execution (#1000) (Mikhail Faraponov)a583006Use bytes.IndexByte instead of bytes.Index for single byte lookup (#999) (Mike Faraponov)860c345Fix unexpected panic when calling Do of a PipelineClient (#997) (blanet)0cd7349ImmediateHeaderFlush when no body (#995) (Vladimir Shteinman)02e0722Add PipelineClient name (#994) (kiyon)1a7995bformat err info (#989) (peakle)f40ea7eImprove socks proxy (#990) (kiyon)34fa9a6Add DisableHeaderNamesNormalizing to PipelineClient (#991) (kiyon)v1.22.0Compare Source
4637395Update deps (Erik Dubbelboer)c3cd5e1Export HostClient.connsCount (#981) (kiyon)a4b0703Implemented DisablePathNormalizing in PipelineClient (#977) (Seva Maltsev)0880335Update compress.go (#978) (Mike Faraponov)e7294d2Update client.go (#979) (Mike Faraponov)62dfc52Fix Client ms cleaner (#975) (kiyon)v1.21.0Compare Source
3cd0862Streaming fixes (#970) (Erik Dubbelboer)1b61ca2Added Protocol() as a replacement of hardcoded strHTTP11 (#969) (Darío)52a8ab6fix s2b go vet warning (#967) (ZhangYunHao)v1.20.0Compare Source
a88030bfix gracefilly shutdown bug, issue #958 (#960) (AlphaBaby)1494fdcFix clientGetURLDeadline (Erik Dubbelboer)0956208Add request body streaming. Fixes #622 (#911) (Kirill Danshin)fbe6a2dAdd fasthttp.GenerateTestCertificate and use in tests (Erik Dubbelboer)838d3abAllow concurrent ServeTLS (Erik Dubbelboer)3cec26dAllow stopping FS handler cleanup gorountine (#942) (Erik Dubbelboer)ed1ceddFix race condition in Client.DoTimeout (Erik Dubbelboer)5661df8Improve documentation about DelClientCookie which related with #951. (#956) (kiyon)b4b40e9Do not start connsCleaner on SetConnectionClosed requests. (#950) (Mike Faraponov)70e00dcIgnore empty Transfer-Encoding headers (Erik Dubbelboer)Configuration
📅 Schedule: (in timezone America/Toronto)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.