You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Glenn Strauss 66624b375b [core] reject Transfer-Encoding + Content-Length (#2985) ... reject requests with both Transfer-Encoding and Content-Length as recommended in RFC 7230 Section 3.3.3. strict header parsing is enabled by default in lighttpd. However, if explicitly disabled in lighttpd.conf, lighttpd will continue to accept Transfer-Encoding and Content-Length in the same request, and will ignore (and remove) Content-Length before passing to backend. UNSAFE: server.http-parseopts = ( "header-strict" => "disable" ) This is NOT RECOMMENDED since doing so disables other protections provided by lighttpd strict http header parsing. RFC7230 Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing 3.3.3. Message Body Length [...] If a message is received with both a Transfer-Encoding and a Content-Length header field, the Transfer-Encoding overrides the Content-Length. Such a message might indicate an attempt to perform request smuggling (Section 9.5) or response splitting (Section 9.4) and ought to be handled as an error. A sender MUST remove the received Content-Length field prior to forwarding such a message downstream. x-ref: stricter request header parsing https://redmine.lighttpd.net/issues/2985		3 years ago
..
t	[core] reject WS following header field-name (fixes #2985)	3 years ago
CMakeLists.txt	[cmake]: enable CMAKE_POSITION_INDEPENDENT_CODE by default	4 years ago
Makefile.am	[build] PGSQL_CFLAGS with pkg-config for postgres (#2965)	4 years ago
SConscript	[mod_maxminddb] MaxMind GeoIP2 support	4 years ago
algo_sha1.c	[mod_auth] use SHA1_Init,Update,Final	5 years ago
algo_sha1.h	[mod_auth] use SHA1_Init,Update,Final	5 years ago
array.c	[core] use buffer_eq_icase_ssn func	4 years ago
array.h	[core] perf: array_reset_data_strings()	4 years ago
base.h	[core] struct log_error_st for error logging	4 years ago
base64.c	[core] fix base64 decode when char is unsigned (fixes #2848)	5 years ago
base64.h	consistent inclusion of config.h at top of files (fixes #2073)	7 years ago
base_decls.h	[core] struct log_error_st for error logging	4 years ago
buffer.c	[multiple] replace strcasecmp() on short strings	4 years ago
buffer.h	[core] mark some more funcs w/ __attribute_pure__	4 years ago
burl.c	[core] remove repeated slashes in http-parseopts	4 years ago
burl.h	[core] config option to allow GET w/ request body	4 years ago
chunk.c	[core] chunkqueue perf: specialized buffer.h funcs	4 years ago
chunk.h	[core] mark some more funcs w/ __attribute_pure__	4 years ago
config.h.cmake	[mod_authn_ldap] replace use of deprecated funcs	5 years ago
configfile-glue.c	[core] perf: simple, quick buffer_clear()	4 years ago
configfile.c	[core] issue config error for invalid ':' (fixes #2980)	4 years ago
configfile.h	[core] mark startup/shutdown funcs cold	4 years ago
configparser.y	[core] mark startup/shutdown funcs cold	4 years ago
connections-glue.c	[core] use buffer_eq_icase* funcs	4 years ago
connections.c	[core] move con state handling to connections*.c	4 years ago
connections.h	[core] move con state handling to connections*.c	4 years ago
crc32.c	consistent inclusion of config.h at top of files (fixes #2073)	7 years ago
crc32.h	[core] some header cleanup	5 years ago
data_array.c	[core] more memory-efficient fn table for data_*	5 years ago
data_config.c	[core] perf: simple, quick buffer_clear()	4 years ago
data_integer.c	[core] perf: simple, quick buffer_clear()	4 years ago
data_string.c	[core] more memory-efficient fn table for data_*	5 years ago
etag.c	[core] use high precision stat timestamp on OS X	4 years ago
etag.h	[core] add const to some etag prototypes	4 years ago
fastcgi.h	[core] fastcgi.h link to Open Market License (OML) (fixes #2901)	5 years ago
fdevent.c	[core] retry on some fdevent set/del temporary err	4 years ago
fdevent.h	[core] fdevent_mkstemp_append() (shared)	4 years ago
fdevent_freebsd_kqueue.c	[core] retry on some fdevent set/del temporary err	4 years ago
fdevent_impl.h	[core] pass (fdnode *) for registered fdevent fd	4 years ago
fdevent_libev.c	[core] some fdevent code streamlining	4 years ago
fdevent_linux_sysepoll.c	[core] clear FDEVENT_RDHUP if no POLLRDHUP	4 years ago
fdevent_poll.c	[core] clear FDEVENT_RDHUP if no POLLRDHUP	4 years ago
fdevent_select.c	[core] some fdevent code streamlining	4 years ago
fdevent_solaris_devpoll.c	[core] replace open() with fdevent_open_cloexec()	4 years ago
fdevent_solaris_port.c	[core] fix compile error on Solaris (fixes #2959)	4 years ago
first.h	[core] correct __attribute_pure__ syntax	4 years ago
gw_backend.c	[core] chunkqueue perf: code reuse	4 years ago
gw_backend.h	[core] pass (fdnode *) for registered fdevent fd	4 years ago
http-header-glue.c	[core] use buffer_eq_icase_ssn func	4 years ago
http_auth.c	[mod_auth] http_auth_const_time_memeq() (#2975, #2976)	4 years ago
http_auth.h	[mod_auth] http_auth_const_time_memeq() (#2975, #2976)	4 years ago
http_chunk.c	[core] adjust http_chunk read() retry loop	4 years ago
http_chunk.h	[core] chunkqueue perf: read small files into mem	4 years ago
http_header.c	[core] improve http_headers[] data struct packing	4 years ago
http_header.h	[core] mark some more funcs w/ __attribute_pure__	4 years ago
http_kv.c	[core] get_http_method_key() match by strlen first	4 years ago
http_kv.h	[core] get_http_method_key() match by strlen first	4 years ago
http_vhostdb.c	[core] initialize globals at top of main()	6 years ago
http_vhostdb.h	[core] some header cleanup	5 years ago
inet_ntop_cache.c	[core] isolate sock_addr manipulation	5 years ago
inet_ntop_cache.h	[core] isolate sock_addr manipulation	5 years ago
joblist.c	[multiple] reduce code dup in list resizing	4 years ago
joblist.h	[core] some header cleanup	5 years ago
keyvalue.c	[multiple] reduce code dup in list resizing	4 years ago
keyvalue.h	[mod_redirect,mod_rewrite] pass request URI info	5 years ago
lemon.c	[core] workaround Coverity cov-build bug with gcc7	5 years ago
lempar.c	fix errors detected by Coverity Scan	7 years ago
lighttpd-angel.c	[core] attempt to quiet coverity false positives	6 years ago
log.c	[core] log_error, log_perror using printf-like fmt	4 years ago
log.h	[core] log_error, log_perror using printf-like fmt	4 years ago
md5.c	[TLS] sys-crypto.h abstraction	5 years ago
md5.h	[core] define MD5_DIGEST_LENGTH 16	4 years ago
meson.build	Also use explicit_memset (NetBSD) with cmake, scons and meson	4 years ago
mod_access.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_accesslog.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_alias.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_auth.c	[mod_auth] http_auth_const_time_memeq() (#2975, #2976)	4 years ago
mod_authn_file.c	[mod_auth] http_auth_const_time_memeq() (#2975, #2976)	4 years ago
mod_authn_gssapi.c	[mod_authn_gssapi] option to store delegated creds (fixes #2967)	4 years ago
mod_authn_ldap.c	[core] use buffer_eq_icase_ssn func	4 years ago
mod_authn_mysql.c	[mod_auth] http_auth_const_time_memeq() (#2975, #2976)	4 years ago
mod_authn_pam.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_authn_sasl.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_cgi.c	[stat_cache] no longer stat() and open() for stat	4 years ago
mod_cml.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_cml.h	[core] some header cleanup	5 years ago
mod_cml_funcs.c	[core] abstraction layer for HTTP header manip	5 years ago
mod_cml_funcs.h	[autobuild] rm module stub code for missing deps	7 years ago
mod_cml_lua.c	[core] pass conf.follow_symlink in more places	4 years ago
mod_compress.c	[core] use buffer_eq_icase_ssn func	4 years ago
mod_deflate.c	[mod_deflate] fix choose encoding parse error (fixes #2981)	4 years ago
mod_dirlisting.c	[core] replace open() with fdevent_open_cloexec()	4 years ago
mod_evasive.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_evhost.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_expire.c	[stat_cache] separate func for symlink policy chk	4 years ago
mod_extforward.c	[multiple] replace strcasecmp() on short strings	4 years ago
mod_fastcgi.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_flv_streaming.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_geoip.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_indexfile.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_magnet.c	[mod_magnet] expose server addr (local IP) to lua	4 years ago
mod_magnet_cache.c	[multiple] reduce code dup in list resizing	4 years ago
mod_magnet_cache.h	[core] some header cleanup	5 years ago
mod_maxminddb.c	[mod_maxminddb] MaxMind GeoIP2 support	4 years ago
mod_mysql_vhost.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_openssl.c	[mod_openssl] use SSL_CTX_set_client_hello_cb()	4 years ago
mod_proxy.c	[core] use buffer_eq_icase_ssn func	4 years ago
mod_redirect.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_rewrite.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_rrdtool.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_scgi.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_secdownload.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_setenv.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_simple_vhost.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_skeleton.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_sockproxy.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_ssi.c	[core] use buffer_eq_icase_ssn func	4 years ago
mod_ssi.h	[core] some header cleanup	5 years ago
mod_ssi_expr.c	[core] some header cleanup	5 years ago
mod_ssi_expr.h	consistent inclusion of config.h at top of files (fixes #2073)	7 years ago
mod_ssi_exprparser.y	[core] remove some unused header includes	6 years ago
mod_staticfile.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_status.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_trigger_b4_dl.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_uploadprogress.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_userdir.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_usertrack.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_vhostdb.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_vhostdb_dbi.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_vhostdb_ldap.c	[core] use buffer_eq_icase_ssn func	4 years ago
mod_vhostdb_mysql.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_vhostdb_pgsql.c	[multiple] cleaner calloc use in SETDEFAULTS_FUNC	4 years ago
mod_webdav.c	[mod_webdav] fix file uploads > 128M (fixes #2970)	4 years ago
mod_wstunnel.c	[core] use buffer_eq_icase_ssn func	4 years ago
network.c	[core] silence coverity warning	4 years ago
network.h	[core] mark startup/shutdown funcs cold	4 years ago
network_write.c	[multiple] better packing of struct chunk	4 years ago
network_write.h	[core] mark startup/shutdown funcs cold	4 years ago
plugin.c	[core] new worker_init hook to follow parent fork	4 years ago
plugin.h	[core] new worker_init hook to follow parent fork	4 years ago
rand.c	[core] pass conf.follow_symlink in more places	4 years ago
rand.h	[core] adjust li_rand_pseudo* interfaces	6 years ago
request.c	[core] reject Transfer-Encoding + Content-Length (#2985)	3 years ago
request.h	[core] pass req hdrs buffer to http_request_parse	4 years ago
response.c	[core] use buffer_eq_icase_ssn func	4 years ago
response.h	[core] extend dir redirection to take HTTP status	4 years ago
safe_memclear.c	Also use explicit_memset (NetBSD) with cmake, scons and meson	4 years ago
safe_memclear.h	[core] some header cleanup	5 years ago
server.c	[core] move con state handling to connections*.c	4 years ago
settings.h	[core] move con state handling to connections*.c	4 years ago
sock_addr.c	[core] avoid freeaddrinfo() on NULL ptr (fixes #2984)	3 years ago
sock_addr.h	[core] isolate sock_addr manipulation	5 years ago
splaytree.c	Fix header inclusion order, always include "config.h" before any system header	14 years ago
splaytree.h	consistent inclusion of config.h at top of files (fixes #2073)	7 years ago
stat_cache.c	[core] disable stat_cache FAM if FAM conn closed	4 years ago
stat_cache.h	[mod_webdav] invalidate parent dir in stat_cache	4 years ago
status_counter.h	[core] inline status_counter routines	5 years ago
stream.c	[core] remove some unused header includes	6 years ago
stream.h	[config] support include file glob (fixes #1221)	7 years ago
sys-crypto.h	[mod_openssl] add support for wolfSSL	5 years ago
sys-endian.h	DragonFlyBSD defines __DragonFly__ (#2746)	7 years ago
sys-mmap.h	consistent inclusion of config.h at top of files (fixes #2073)	7 years ago
sys-socket.h	[core] some header cleanup	5 years ago
sys-strings.h	[core] sys-strings.h abstraction for strings.h	6 years ago
vector.c	[core] some header cleanup	5 years ago
vector.h	[core] some header cleanup	5 years ago