Multiple bugfixes, security issue and CI improvements - #372
Merged
Conversation
…etup Security and correctness: - escape: fix no-op assert that let non-string input through (XSS) - web: constant-time compare of secure-cookie HMAC (timing attack) - util/websocket: derive WebSocket masks and rand_str from OS entropy (secure_random_bytes) instead of math.random - mustache: render number and function values in top-level templates and partials, propagate safe mode into partials, match section-end by name (#198) - httputil: empty URL parameter "?foo=" now yields "" instead of being dropped (#205) - structs/buffer: grow by min(size, 1MB) past 1MB instead of always doubling to avoid pathological memory use on large uploads (#352) - crypto_linux: use OPENSSL_init_ssl() with a legacy fallback so SSL init works on OpenSSL >= 1.1.0 / 3.0 (#368) Platform: - Add ARM64/aarch64 support in platform, syscall, cdef and fs (#362) - ioloop: reuse callback/timeout tables to reduce GC churn Tests and infrastructure: - Add spec/security_spec.lua; add regression tests to mustache, structs and httputil specs - Add Dockerfile, docker/busted-luajit and a Makefile docker-test target to run the suite under LuaJIT on Linux (replaces the defunct Travis CI) - Add bench/ IO benchmarks Bump copyright year on touched files.
Reuse the Dockerfile and make docker-test; point the README badge at it instead of the defunct Travis CI.
struct epoll_event is packed only on x86/x86_64; on aarch64 it is naturally aligned, so epoll_wait results were misread, the loop spun on "no handler for fd: 0" and no connections were served. Use the aligned layout there. Add a localhost round-trip regression test.
Header CRLF injection, unbounded request-body DoS, Transfer-Encoding smuggling, WebSocket fragment-reassembly DoS, HEAD path traversal, secure-cookie name binding, and a C header-parser memory leak. Adds regression tests.
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Collected fixes on top of the earlier Docker/CI work.
aarch64 (ARM64) support corrects the stat struct layout and syscall
numbers (newfstatat, incorporating @seclorum's additions from #371), and
fixes struct epoll_event, which was packed for every 64-bit ABI but must be
naturally aligned on aarch64 (otherwise the event loop misreads epoll_wait
results and serves nothing). Verified on real aarch64.
Security
client's Content-Length, so it never triggered → memory DoS).
are framed by Content-Length only.
the HEAD handler is also fixed.
returns the default instead of raising on a bad cookie.
value leaked its key/value struct).
Other
Regression tests added; unit suite green under LuaJIT on Linux (CI) and locally.
Closes #368
Closes #362
Closes #352
Closes #205
Closes #198