From 4389aafb7f5f85b6fe7199ef7c428d09b2e89191 Mon Sep 17 00:00:00 2001
From: Branislav Kontur Sourced from ws's
releases. A request with a number of headers exceeding
the[ const wss = new WebSocket.Server({ port: 0 }, function () {
const chars =
"!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0; for (let i = 0; i < chars.length; i++) {
if (count === 2000) break; } headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13'; const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
}); request.end();
});
tower::Layer for NodeHealthProxyLayer {
+ type Service = NodeHealthProxy;
+
+ fn layer(&self, service: S) -> Self::Service {
+ NodeHealthProxy::new(service)
+ }
+}
+
+/// Middleware that proxies `/health` and `/health/readiness` endpoints.
+pub struct NodeHealthProxy(S);
+
+impl NodeHealthProxy {
+ /// Creates a new [`NodeHealthProxy`].
+ pub fn new(service: S) -> Self {
+ Self(service)
+ }
+}
+
+impl tower::Service
+where
+ S: ServiceCommits
5312a03
curve: Bump version to 4.1.3 (#660)b4f9e4d
SECURITY: fix timing variability in backend/serial/u32/scalar.rs (#661)415892a
SECURITY: fix timing variability in backend/serial/u64/scalar.rs (#659)56bf398
Updates license field to valid SPDX format (#647)9252fa5
Mitigate check-cfg until MSRV 1.77 (#652)1efe6a9
Fix a minor typo in signing.rs (#649)cc3421a
Indicate that the rand_core feature is required (#641)858c4ca
Address new nightly clippy unnecessary qualifications (#639)31ccb67
Remove platforms in favor using CARGO_CFG_TARGET_POINTER_WIDTH (#636)19c7f4a
Fix new nightly redundant import lint warns (#638)
[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=curve25519-dalek&package-manager=cargo&previous-version=4.1.2&new-version=4.1.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show Release notes
8.17.1
Bug fixes
server.maxHeadersCount
][]
threshold could be used to crash a ws server.const http = require('http');
const WebSocket = require('ws');
for (let j = 0; j < chars.length; j++) {
const key = chars[i] + chars[j];
headers[key] = 'x';
if (++count === 2000) break;
}
The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.
In vulnerable versions of ws, the issue can be mitigated in the following ways:
--max-http-header-size=size
][] and/or the
[maxHeaderSize
][] options so
that no more headers than the server.maxHeadersCount
limit
can be sent.... (truncated)
3c56601
[dist] 8.17.1e55e510
[security] Fix crash when the Upgrade header cannot be read (#2231)6a00029
[test] Increase code coverageddfe4a8
[perf] Reduce the amount of crypto.randomFillSync()
callsb73b118
[dist] 8.17.029694a5
[test] Use the highWaterMark
variable934c9d6
[ci] Test on node 221817bac
[ci] Do not test on node 2196c9b3d
[major] Flip the default value of allowSynchronousEvents
(#2221)e5f32c7
[fix] Emit at most one event per event loop iteration (#2218)