Skip to content

Bump netty to 4.1.60.Final #1775 #1782

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Mar 27, 2021

Conversation

hysterus1
Copy link
Contributor

Hello, I'm kindly asking to treat this PR with high priority as it involves security of the library. #1775

@hysterus1 hysterus1 force-pushed the bump-netty-to-4-1-60 branch 2 times, most recently from 67e05e8 to 2c919d3 Compare March 17, 2021 09:28
X-Duplicated-Header as Netty added normalization against the
Content-Length header
@hysterus1 hysterus1 force-pushed the bump-netty-to-4-1-60 branch from 2c919d3 to 52afb50 Compare March 17, 2021 11:00
@hysterus1
Copy link
Contributor Author

hysterus1 commented Mar 17, 2021

Netty has added special normalization and validation for the Content-Length header. In case the headers are duplicated, the receiver should either reject the response or only pick and parse the correct header entry. Long story short, with newest Netty one can't have this header duplicated.

That is not a big problem for async-http-client, as the old behavior was only relied on in the tests. I've adjusted the tests to simply use a different header instead.

@hysterus1
Copy link
Contributor Author

I will wait for the build to pass and then squash the commits.

@TomGranot
Copy link
Contributor

@hysterus1 Note that that CircleCI build passed, but the GitHub Actions one failed. Ran this locally and this passed too - GH had a few timeouts issues in the past due to (what I think is) the amount of "power" each allocated test agent gets (CPU, RAM, etc...).

Merged.

@TomGranot TomGranot merged commit 7201bf1 into AsyncHttpClient:master Mar 27, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants