Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

pointfix for websocket client DoS #2039

Merged
merged 2 commits into from
Jan 22, 2023
Merged

pointfix for websocket client DoS #2039

merged 2 commits into from
Jan 22, 2023

Commits on Jan 22, 2023

  1. fix a DoS against websocket clients 

    I assumed gorilla validated UTF8 for incoming text messages. In fact, the
documentation states:

>It is the application's responsibility to ensure that text messages
>are valid UTF-8 encoded text.

and this applies to both incoming and outgoing messages. Consequently,
even when enforce-utf8 is enabled, it was possible to send invalid UTF8
to Ergo inside a websocket text frame. This data would be incorrectly
considered valid UTF8, and could be relayed to other clients, including
to websocket clients inside a text frame. The resulting frame would violate
the websocket protocol, causing web clients to be disconnected.
    @slingamn
    slingamn committed Jan 22, 2023
    Configuration menu
    Copy the full SHA
    9589d01 View commit details
    Browse the repository at this point in the history

  2. bump version and changelog for pointfix

    @slingamn
    slingamn committed Jan 22, 2023
    Configuration menu
    Copy the full SHA
    ca03a42 View commit details
    Browse the repository at this point in the history