unicorn Ruby/Rack server user+dev discussion/patches/pulls/bugs/help
 help / color / mirror / code / Atom feed
From: Eric Wong <normalperson@yhbt.net>
To: Dirkjan Bussink <dbussink@github.com>
Cc: John Crepezzi <seejohnrun@github.com>,
	Kevin Sawicki <kevinsawicki@github.com>,
	unicorn-public@yhbt.net
Subject: Re: Potential Unicorn vulnerability
Date: Sat, 13 Mar 2021 02:26:15 +0000
Message-ID: <20210313022615.GA32198@dcvr> (raw)
In-Reply-To: <66A68DD8-83EF-4C7A-80E8-3F1F7AB31670@github.com>

Dirkjan Bussink <dbussink@github.com> wrote:
> Ah yeah. So do you think that on top of the current patch we’d need
> something like the attached patch (which moves the @request allocation),
> or would only the latter patch be needed then?

Not really, aside from the OobGC change and hijack test removal.

Anyways, I've squashed the test removal, OobGC adjustment, and
your 2nd patch together as commit c917ac526df214611ec33c21de2b070452ec8434
and pushed it out as the "v6-wip" branch.

> In the latter case there’s still a bunch of logic for Rack hijack around
> then which might not be needed at that point, but I’m not entirely sure
> how that would look like.

Yes, though there are also some other HTTP servers that use the
parser.  I prefer to minimize changes to the ext code at this
point given the relative lack of C/Ragel-knowledgeable users
compared to Ruby-knowledgeable

  reply	other threads:[~2021-03-13  2:26 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <F6712BF3-A4DD-41EE-8252-B9799B35E618@github.com>
     [not found] ` <20210311030250.GA1266@dcvr>
     [not found]   ` <7F6FD017-7802-4871-88A3-1E03D26D967C@github.com>
2021-03-12  9:41     ` Eric Wong
2021-03-12 11:14       ` Dirkjan Bussink
2021-03-12 12:00         ` Eric Wong
2021-03-12 12:24           ` Dirkjan Bussink
2021-03-13  2:26             ` Eric Wong [this message]
2021-03-13  2:31               ` [PATCH] http_request: drop unnecessary #clear call Eric Wong
2021-03-16 10:15               ` Potential Unicorn vulnerability Dirkjan Bussink
2021-03-16 10:31                 ` Eric Wong
2021-03-17  8:03                   ` Dirkjan Bussink
2021-03-17  8:47                     ` Eric Wong
2021-03-19 13:55                       ` Dirkjan Bussink

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://yhbt.net/unicorn/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210313022615.GA32198@dcvr \
    --to=normalperson@yhbt.net \
    --cc=dbussink@github.com \
    --cc=kevinsawicki@github.com \
    --cc=seejohnrun@github.com \
    --cc=unicorn-public@yhbt.net \
    --subject='Re: Potential Unicorn vulnerability' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

unicorn Ruby/Rack server user+dev discussion/patches/pulls/bugs/help

This inbox may be cloned and mirrored by anyone:

	git clone --mirror https://yhbt.net/unicorn-public
	git clone --mirror http://ou63pmih66umazou.onion/unicorn-public

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V1 unicorn-public unicorn-public/ https://yhbt.net/unicorn-public \
		unicorn-public@yhbt.net unicorn-public@bogomips.org mongrel-unicorn@rubyforge.org mongrel-unicorn-GrnCvJ7WPxnNLxjTenLetw@public.gmane.org
	public-inbox-index unicorn-public

Example config snippet for mirrors.
Newsgroups are available over NNTP:
	nntp://news.public-inbox.org/inbox.comp.lang.ruby.unicorn
	nntp://ou63pmih66umazou.onion/inbox.comp.lang.ruby.unicorn
 note: .onion URLs require Tor: https://www.torproject.org/

code repositories for project(s) associated with this inbox:

	../../unicorn.git

AGPL code for this site: git clone http://ou63pmih66umazou.onion/public-inbox.git