GeezerVison is showing github.com — deps: update llhttp to 9.4.1 · nodejs/node@62fe0cf
File treeExpand file treeCollapse file tree Open diff view settings Expand file treeCollapse file tree Open diff view settings Collapse file Copy file name to clipboardExpand all lines: deps/llhttp/CMakeLists.txt +32-13Lines changed: 32 additions & 13 deletions | Original file line number | Diff line number | Diff line change |
|---|
| 1 | 1 | cmake_minimum_required(VERSION 3.25.0) | 2 | 2 | cmake_policy(SET CMP0069 NEW) | 3 | 3 |
| 4 | | -project(llhttp VERSION 9.3.1) | | 4 | +project(llhttp VERSION 9.4.1) | 5 | 5 | include(GNUInstallDirs) | | 6 | +include(CMakePackageConfigHelpers) | 6 | 7 |
| 7 | 8 | set(CMAKE_C_STANDARD 99) | 8 | 9 |
| @@ -66,18 +67,6 @@ function(config_library target) | 66 | 67 | ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR} | 67 | 68 | PUBLIC_HEADER DESTINATION ${CMAKE_INSTALL_INCLUDEDIR} | 68 | 69 | ) | 69 | | - | 70 | | - install(FILES | 71 | | - ${CMAKE_CURRENT_SOURCE_DIR}/libllhttp.pc | 72 | | - DESTINATION ${CMAKE_INSTALL_LIBDIR}/pkgconfig | 73 | | - ) | 74 | | - | 75 | | - # This is required to work with FetchContent | 76 | | - install(EXPORT llhttp | 77 | | - FILE llhttp-config.cmake | 78 | | - NAMESPACE llhttp:: | 79 | | - DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/llhttp | 80 | | - ) | 81 | 70 | endfunction(config_library target) | 82 | 71 |
| 83 | 72 | if(LLHTTP_BUILD_SHARED_LIBS) | @@ -98,6 +87,36 @@ if(LLHTTP_BUILD_STATIC_LIBS) | 98 | 87 | config_library(llhttp_static) | 99 | 88 | endif() | 100 | 89 |
| | 90 | +if(TARGET llhttp_shared OR TARGET llhttp_static) | | 91 | + install(FILES | | 92 | + ${CMAKE_CURRENT_SOURCE_DIR}/libllhttp.pc | | 93 | + DESTINATION ${CMAKE_INSTALL_LIBDIR}/pkgconfig | | 94 | + ) | | 95 | + | | 96 | + install(EXPORT llhttp | | 97 | + FILE llhttp-targets.cmake | | 98 | + NAMESPACE llhttp:: | | 99 | + DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/llhttp | | 100 | + ) | | 101 | + | | 102 | + configure_package_config_file( | | 103 | + ${CMAKE_CURRENT_SOURCE_DIR}/cmake/llhttpConfig.cmake.in | | 104 | + ${CMAKE_CURRENT_BINARY_DIR}/llhttpConfig.cmake | | 105 | + INSTALL_DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/llhttp | | 106 | + ) | | 107 | + | | 108 | + write_basic_package_version_file( | | 109 | + ${CMAKE_CURRENT_BINARY_DIR}/llhttpConfigVersion.cmake | | 110 | + COMPATIBILITY AnyNewerVersion | | 111 | + ) | | 112 | + | | 113 | + install(FILES | | 114 | + ${CMAKE_CURRENT_BINARY_DIR}/llhttpConfig.cmake | | 115 | + ${CMAKE_CURRENT_BINARY_DIR}/llhttpConfigVersion.cmake | | 116 | + DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/llhttp | | 117 | + ) | | 118 | +endif() | | 119 | + | 101 | 120 | # On windows with Visual Studio, add a debug postfix so that release | 102 | 121 | # and debug libraries can coexist. | 103 | 122 | if(MSVC) | |
Collapse file Copy file name to clipboardExpand all lines: deps/llhttp/LICENSE +2-2Lines changed: 2 additions & 2 deletions | Original file line number | Diff line number | Diff line change |
|---|
| 1 | | -This software is licensed under the MIT License. | | 1 | +MIT License | 2 | 2 |
| 3 | | -Copyright Fedor Indutny, 2018. | | 3 | +Copyright © 2018 Fedor Indutny | 4 | 4 |
| 5 | 5 | Permission is hereby granted, free of charge, to any person obtaining a | 6 | 6 | copy of this software and associated documentation files (the | |
Collapse file Copy file name to clipboardExpand all lines: deps/llhttp/README.md +11-1Lines changed: 11 additions & 1 deletion - Display the source diff
- Display the rich diff
| Original file line number | Diff line number | Diff line change |
|---|
@@ -112,7 +112,7 @@ The following callbacks can return `0` (proceed normally), `-1` (error) or `HPE_ | 112 | 112 | * `on_message_complete`: Invoked when a request/response has been completedly parsed. | 113 | 113 | * `on_url_complete`: Invoked after the URL has been parsed. | 114 | 114 | * `on_method_complete`: Invoked after the HTTP method has been parsed. | 115 | | -* `on_protocol_complete`: Invoked after the HTTP version has been parsed. | | 115 | +* `on_protocol_complete`: Invoked after the protocol has been parsed. | 116 | 116 | * `on_version_complete`: Invoked after the HTTP version has been parsed. | 117 | 117 | * `on_status_complete`: Invoked after the status code has been parsed. | 118 | 118 | * `on_header_field_complete`: Invoked after a header name has been parsed. | @@ -397,6 +397,16 @@ With this flag this check is disabled. | 397 | 397 |
| 398 | 398 | **Enabling this flag can pose a security issue since you will be exposed to request smuggling attacks. USE WITH CAUTION!** | 399 | 399 |
| | 400 | +### `void llhttp_set_lenient_header_value_relaxed(llhttp_t* parser, int enabled)` | | 401 | +
| | 402 | +Enables/disables relaxed handling of control characters in header values. | | 403 | +
| | 404 | +Normally `llhttp` would error when header values contain characters not in the valid set (HTAB, SP, VCHAR, OBS_TEXT). With | | 405 | +this flag, control characters (except for NULL, CR & LF) will be accepted in header values. | | 406 | +
| | 407 | +This does not create any known security issue, but does allow content considered 'invalid' by | | 408 | +[RFC 9110](https://www.rfc-editor.org/rfc/rfc9110#name-field-values) and so should be avoided by default. | | 409 | +
| 400 | 410 | ## Build Instructions | 401 | 411 |
| 402 | 412 | Make sure you have [Node.js](https://nodejs.org/), npm and npx installed. Then under project directory run: | |
Collapse file Copy file name to clipboard +19Lines changed: 19 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
| | 1 | +@PACKAGE_INIT@ | | 2 | + | | 3 | +include("${CMAKE_CURRENT_LIST_DIR}/llhttp-targets.cmake") | | 4 | + | | 5 | +if(NOT TARGET llhttp::llhttp) | | 6 | + if(TARGET llhttp::llhttp_shared) | | 7 | + add_library(llhttp::llhttp INTERFACE IMPORTED) | | 8 | + set_property(TARGET llhttp::llhttp PROPERTY | | 9 | + INTERFACE_LINK_LIBRARIES llhttp::llhttp_shared | | 10 | + ) | | 11 | + elseif(TARGET llhttp::llhttp_static) | | 12 | + add_library(llhttp::llhttp INTERFACE IMPORTED) | | 13 | + set_property(TARGET llhttp::llhttp PROPERTY | | 14 | + INTERFACE_LINK_LIBRARIES llhttp::llhttp_static | | 15 | + ) | | 16 | + endif() | | 17 | +endif() | | 18 | + | | 19 | +check_required_components(llhttp) |
Collapse file Copy file name to clipboardExpand all lines: deps/llhttp/include/llhttp.h +20-2Lines changed: 20 additions & 2 deletions | Original file line number | Diff line number | Diff line change |
|---|
| 3 | 3 | #define INCLUDE_LLHTTP_H_ | 4 | 4 |
| 5 | 5 | #define LLHTTP_VERSION_MAJOR 9 | 6 | | -#define LLHTTP_VERSION_MINOR 3 | | 6 | +#define LLHTTP_VERSION_MINOR 4 | 7 | 7 | #define LLHTTP_VERSION_PATCH 1 | 8 | 8 |
| 9 | 9 | #ifndef INCLUDE_LLHTTP_ITSELF_H_ | @@ -118,7 +118,8 @@ enum llhttp_lenient_flags { | 118 | 118 | LENIENT_OPTIONAL_LF_AFTER_CR = 0x40, | 119 | 119 | LENIENT_OPTIONAL_CRLF_AFTER_CHUNK = 0x80, | 120 | 120 | LENIENT_OPTIONAL_CR_BEFORE_LF = 0x100, | 121 | | - LENIENT_SPACES_AFTER_CHUNK_SIZE = 0x200 | | 121 | + LENIENT_SPACES_AFTER_CHUNK_SIZE = 0x200, | | 122 | + LENIENT_HEADER_VALUE_RELAXED = 0x400 | 122 | 123 | }; | 123 | 124 | typedef enum llhttp_lenient_flags llhttp_lenient_flags_t; | 124 | 125 |
| @@ -898,6 +899,23 @@ void llhttp_set_lenient_optional_crlf_after_chunk(llhttp_t* parser, int enabled) | 898 | 899 | LLHTTP_EXPORT | 899 | 900 | void llhttp_set_lenient_spaces_after_chunk_size(llhttp_t* parser, int enabled); | 900 | 901 |
| | 902 | +/* Enables/disables relaxed handling of unusual characters in header values. | | 903 | + * | | 904 | + * RFC 9110 describes NULL, CR and LF as 'dangerous' and says they MUST be | | 905 | + * rejected, while other control characters are merely 'invalid' and discouraged, | | 906 | + * and are explicitly allowed by other standards (e.g. WHATWG Fetch) and | | 907 | + * in surprisingly common use on the web. | | 908 | + * | | 909 | + * This flag enables these 'invalid but common' characters, aiming to | | 910 | + * maximize compatibility without enabling any potentially dangerous scenarios. | | 911 | + * | | 912 | + * Unlike `llhttp_set_lenient_headers()`, this does NOT enable any other | | 913 | + * potentially unsafe behaviors (like accepting whitespace before colons | | 914 | + * or after the start line). | | 915 | + */ | | 916 | +LLHTTP_EXPORT | | 917 | +void llhttp_set_lenient_header_value_relaxed(llhttp_t* parser, int enabled); | | 918 | + | 901 | 919 | #ifdef __cplusplus | 902 | 920 | } /* extern "C" */ | 903 | 921 | #endif | |
Collapse file Copy file name to clipboardExpand all lines: deps/llhttp/src/api.c +8Lines changed: 8 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -316,6 +316,14 @@ void llhttp_set_lenient_spaces_after_chunk_size(llhttp_t* parser, int enabled) { | 316 | 316 | } | 317 | 317 | } | 318 | 318 |
| | 319 | +void llhttp_set_lenient_header_value_relaxed(llhttp_t* parser, int enabled) { | | 320 | + if (enabled) { | | 321 | + parser->lenient_flags |= LENIENT_HEADER_VALUE_RELAXED; | | 322 | + } else { | | 323 | + parser->lenient_flags &= ~LENIENT_HEADER_VALUE_RELAXED; | | 324 | + } | | 325 | +} | | 326 | + | 319 | 327 | /* Callbacks */ | 320 | 328 |
| 321 | 329 |
| |
|