Skip to content

Parser and genertal compliance fixes - #2574

Draft
marty1885 wants to merge 16 commits into
drogonframework:masterfrom
marty1885:tlsupdate
Draft

Parser and genertal compliance fixes#2574
marty1885 wants to merge 16 commits into
drogonframework:masterfrom
marty1885:tlsupdate

Conversation

@marty1885

@marty1885 marty1885 commented Aug 29, 2026

Copy link
Copy Markdown
Member

In light of current wave of AI based vulns. This PR introduces several fixes into the core framework, unfortunately may impact performance

  • Replace sto* with utils::fromString - sto* does not always cleanly parse integers according to RFC (ex. 123x will be parsed by atoi as 123)
  • Fix HttpClient leaking if connection breaks mid request
  • Validate incoming headers does not contain stray \r or \n or NUL (according to RFC)
  • Make sure supplied port numbers are withing uint16 limits and error if not
  • Validate the claimed content length in request == number of bytes we got
  • Limit the total size of headers (previously not limited)

@marty1885 marty1885 changed the title Parser and genertal compliense fixes Parser and genertal compliance fixes Aug 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant