Skip to content

Parser and genertal compliance fixes - #2574

Open
marty1885 wants to merge 23 commits into
drogonframework:masterfrom
marty1885:tlsupdate
Open

Parser and genertal compliance fixes#2574
marty1885 wants to merge 23 commits into
drogonframework:masterfrom
marty1885:tlsupdate

Conversation

@marty1885

@marty1885 marty1885 commented Aug 29, 2026

Copy link
Copy Markdown
Member

In light of current wave of AI based vulns. This PR introduces several fixes into the core framework, unfortunately may impact performance

  • Replace sto* with utils::fromString - sto* does not always cleanly parse integers according to RFC (ex. 123x will be parsed by atoi as 123)
  • Fix HttpClient leaking if connection breaks mid request
  • Validate incoming headers does not contain stray \r or \n or NUL (according to RFC)
  • Make sure supplied port numbers are withing uint16 limits and error if not
  • Validate the claimed content length in request == number of bytes we got
  • Limit the total size of headers (previously not limited)
  • Fix inconstancy in cookie parsing and applying
  • Make HttpClient automatically fail to connect to HTTPS if Trantor is not built with TLS support
  • Various HTTP/1.x protocol validation fixes
  • Fix race condition in SessionManager
  • Fix path parsing and preventing traversal on Windows
  • Validate port in resolver

@marty1885 marty1885 changed the title Parser and genertal compliense fixes Parser and genertal compliance fixes Aug 29, 2026
@marty1885
marty1885 marked this pull request as ready for review September 4, 2026 05:46
@marty1885
marty1885 requested review from an-tao and hwc0919 September 4, 2026 05:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant