Page MenuHomePhorge
Files F85595519

No OneTemporary
Actions

Size
9 KB
Referenced Files
None
Subscribers
None

View Options

diff --git a/DEVLOG.md b/DEVLOG.md
index 4c2151807..25f07171f 100644
--- a/DEVLOG.md
+++ b/DEVLOG.md
@@ -10,3 +10,4 @@
- SOCKS4 is not supported by Gun 2.2 and is now rejected explicitly by the Gun adapter.
- Gun reports a stale stream error to the process that calls `cancel/2`; pool workers must consume that reply so one HTTP/2 cancellation cannot terminate other multiplexed requests.
- Streamed uploads must be registered before body enumeration and cancelled if enumeration exits, throws, or raises, otherwise a partial HTTP/1 request can remain reusable.
+- Gun 2.4 bounds HTTP/1 response header and trailer buffers, rejects invalid request headers by default, and fixes cross-origin HTTP/2 push handling; Gun 2.4.1 includes Cowlib 2.17.1 to repair HTTP/2 HPACK decoding.
diff --git a/changelog.d/gun-pool-rework.fix b/changelog.d/gun-pool-rework.fix
index 309bcab7e..b7d9adccf 100644
--- a/changelog.d/gun-pool-rework.fix
+++ b/changelog.d/gun-pool-rework.fix
@@ -1 +1 @@
-Fixed Gun HTTP/1 concurrency, authenticated proxy handling, tunnel requests, and streamed connection cleanup.
+Fixed Gun HTTP/1 concurrency, authenticated proxy handling, tunnel requests, and streamed connection cleanup. Updated Gun and Cowlib for HTTP client security fixes.
diff --git a/lib/pleroma/http/adapter/gun.ex b/lib/pleroma/http/adapter/gun.ex
index 400692790..61d297101 100644
--- a/lib/pleroma/http/adapter/gun.ex
+++ b/lib/pleroma/http/adapter/gun.ex
@@ -38,7 +38,16 @@ defmodule Pleroma.HTTP.Adapter.Gun do
method = Tesla.Adapter.Shared.format_method(env.method)
{headers, body, send_body} = prepare_body(env.headers, env.body, opts[:send_body])
request_opts = request_opts(opts[:reply_to], tunnel)
- stream = open_stream(conn, method, path, headers, body, request_opts, send_body)
+
+ stream =
+ try do
+ open_stream(conn, method, path, headers, body, request_opts, send_body)
+ catch
+ kind, reason ->
+ ConnectionPool.release_conn(conn)
+ :erlang.raise(kind, reason, __STACKTRACE__)
+ end
+
:ok = ConnectionPool.register_stream(conn, stream)
:ok = send_stream_body(conn, stream, body, send_body)
response = read_response(conn, stream, opts)
diff --git a/mix.exs b/mix.exs
index 3d525b321..f2a48588d 100644
--- a/mix.exs
+++ b/mix.exs
@@ -147,8 +147,8 @@ defmodule Pleroma.Mixfile do
{:cachex, "~> 3.6"},
{:tesla, "~> 1.15"},
{:castore, "~> 1.0"},
- {:cowlib, "~> 2.15"},
- {:gun, "~> 2.2"},
+ {:cowlib, "~> 2.17.1"},
+ {:gun, "~> 2.4.1"},
{:finch, "~> 0.20"},
{:jason, "~> 1.4"},
{:mogrify, "~> 0.9.3", override: true},
diff --git a/mix.lock b/mix.lock
index cde864084..a4db3f68d 100644
--- a/mix.lock
+++ b/mix.lock
@@ -22,7 +22,7 @@
"covertool": {:hex, :covertool, "2.0.7", "398be995c4cf1a2861174389b3577ca97beee43b60c8f1afcf510f1b07d32408", [:rebar3], [], "hexpm", "46158ed6e1a0df7c0a912e314c7b8e053bd74daa5fc6b790614922a155b5720c"},
"cowboy": {:hex, :cowboy, "2.13.0", "09d770dd5f6a22cc60c071f432cd7cb87776164527f205c5a6b0f24ff6b38990", [:make, :rebar3], [{:cowlib, ">= 2.14.0 and < 3.0.0", [hex: :cowlib, repo: "hexpm", optional: false]}, {:ranch, ">= 1.8.0 and < 3.0.0", [hex: :ranch, repo: "hexpm", optional: false]}], "hexpm", "e724d3a70995025d654c1992c7b11dbfea95205c047d86ff9bf1cda92ddc5614"},
"cowboy_telemetry": {:hex, :cowboy_telemetry, "0.4.0", "f239f68b588efa7707abce16a84d0d2acf3a0f50571f8bb7f56a15865aae820c", [:rebar3], [{:cowboy, "~> 2.7", [hex: :cowboy, repo: "hexpm", optional: false]}, {:telemetry, "~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "7d98bac1ee4565d31b62d59f8823dfd8356a169e7fcbb83831b8a5397404c9de"},
- "cowlib": {:hex, :cowlib, "2.15.0", "3c97a318a933962d1c12b96ab7c1d728267d2c523c25a5b57b0f93392b6e9e25", [:make, :rebar3], [], "hexpm", "4f00c879a64b4fe7c8fcb42a4281925e9ffdb928820b03c3ad325a617e857532"},
+ "cowlib": {:hex, :cowlib, "2.17.1", "3e6053016d1ab245730f0af688755476dcedb1c25ed8fb5751f59a2bfdc0c9af", [:make, :rebar3], [], "hexpm", "ff08bd17e6dd931445b18af77315b9b5fe052407110964ad2588c686b57b5e3f"},
"credo": {:hex, :credo, "1.7.12", "9e3c20463de4b5f3f23721527fcaf16722ec815e70ff6c60b86412c695d426c1", [:mix], [{:bunt, "~> 0.2.1 or ~> 1.0", [hex: :bunt, repo: "hexpm", optional: false]}, {:file_system, "~> 0.2 or ~> 1.0", [hex: :file_system, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}], "hexpm", "8493d45c656c5427d9c729235b99d498bd133421f3e0a683e5c1b561471291e5"},
"crontab": {:hex, :crontab, "1.1.8", "2ce0e74777dfcadb28a1debbea707e58b879e6aa0ffbf9c9bb540887bce43617", [:mix], [{:ecto, "~> 1.0 or ~> 2.0 or ~> 3.0", [hex: :ecto, repo: "hexpm", optional: true]}], "hexpm"},
"custom_base": {:hex, :custom_base, "0.2.1", "4a832a42ea0552299d81652aa0b1f775d462175293e99dfbe4d7dbaab785a706", [:mix], [], "hexpm", "8df019facc5ec9603e94f7270f1ac73ddf339f56ade76a721eaa57c1493ba463"},
@@ -58,7 +58,7 @@
"floki": {:hex, :floki, "0.38.0", "62b642386fa3f2f90713f6e231da0fa3256e41ef1089f83b6ceac7a3fd3abf33", [:mix], [], "hexpm", "a5943ee91e93fb2d635b612caf5508e36d37548e84928463ef9dd986f0d1abd9"},
"gen_smtp": {:hex, :gen_smtp, "0.15.0", "9f51960c17769b26833b50df0b96123605a8024738b62db747fece14eb2fbfcc", [:rebar3], [], "hexpm", "29bd14a88030980849c7ed2447b8db6d6c9278a28b11a44cafe41b791205440f"},
"gettext": {:hex, :gettext, "0.24.0", "6f4d90ac5f3111673cbefc4ebee96fe5f37a114861ab8c7b7d5b30a1108ce6d8", [:mix], [{:expo, "~> 0.5.1", [hex: :expo, repo: "hexpm", optional: false]}], "hexpm", "bdf75cdfcbe9e4622dd18e034b227d77dd17f0f133853a1c73b97b3d6c770e8b"},
- "gun": {:hex, :gun, "2.2.0", "b8f6b7d417e277d4c2b0dc3c07dfdf892447b087f1cc1caff9c0f556b884e33d", [:make, :rebar3], [{:cowlib, ">= 2.15.0 and < 3.0.0", [hex: :cowlib, repo: "hexpm", optional: false]}], "hexpm", "76022700c64287feb4df93a1795cff6741b83fb37415c40c34c38d2a4645261a"},
+ "gun": {:hex, :gun, "2.4.1", "c3a8bff8e155e1fc8e499216599bb7effbd27bc1985662a8b25016090dc18428", [:make, :rebar3], [{:cowlib, ">= 2.15.0 and < 3.0.0", [hex: :cowlib, repo: "hexpm", optional: false]}], "hexpm", "1450575b4d393aa0811322727b90ad1dd94b5c10026f54a1641785bcbd250384"},
"hackney": {:hex, :hackney, "1.20.1", "8d97aec62ddddd757d128bfd1df6c5861093419f8f7a4223823537bad5d064e2", [:rebar3], [{:certifi, "~> 2.12.0", [hex: :certifi, repo: "hexpm", optional: false]}, {:idna, "~> 6.1.0", [hex: :idna, repo: "hexpm", optional: false]}, {:metrics, "~> 1.0.0", [hex: :metrics, repo: "hexpm", optional: false]}, {:mimerl, "~> 1.1", [hex: :mimerl, repo: "hexpm", optional: false]}, {:parse_trans, "3.4.1", [hex: :parse_trans, repo: "hexpm", optional: false]}, {:ssl_verify_fun, "~> 1.1.0", [hex: :ssl_verify_fun, repo: "hexpm", optional: false]}, {:unicode_util_compat, "~> 0.7.0", [hex: :unicode_util_compat, repo: "hexpm", optional: false]}], "hexpm", "fe9094e5f1a2a2c0a7d10918fee36bfec0ec2a979994cff8cfe8058cd9af38e3"},
"hpax": {:hex, :hpax, "1.0.3", "ed67ef51ad4df91e75cc6a1494f851850c0bd98ebc0be6e81b026e765ee535aa", [:mix], [], "hexpm", "8eab6e1cfa8d5918c2ce4ba43588e894af35dbd8e91e6e55c817bca5847df34a"},
"html_entities": {:hex, :html_entities, "0.5.2", "9e47e70598da7de2a9ff6af8758399251db6dbb7eebe2b013f2bbd2515895c3c", [:mix], [], "hexpm", "c53ba390403485615623b9531e97696f076ed415e8d8058b1dbaa28181f4fdcc"},
diff --git a/test/pleroma/http/gun_integration_test.exs b/test/pleroma/http/gun_integration_test.exs
index ca6f7bbc1..f50f8105e 100644
--- a/test/pleroma/http/gun_integration_test.exs
+++ b/test/pleroma/http/gun_integration_test.exs
@@ -177,6 +177,28 @@ defmodule Pleroma.HTTP.GunIntegrationTest do
assert {:ok, %Tesla.Env{status: 200, body: "ok"}} = request(origin.base_url <> "/final")
end
+ test "releases the lease when Gun rejects an invalid request header", %{origin: origin} do
+ adapter_opts = [
+ tls_opts: [verify: :verify_none],
+ connect_timeout: 2_000,
+ timeout: 2_000
+ ]
+
+ client = Tesla.client([ConnectionPool], Tesla.Adapter.Gun)
+
+ assert {:invalid_request_header, "x-test", _message} =
+ catch_error(
+ Tesla.get(client, origin.base_url <> "/final",
+ headers: [{"x-test", "value\r\nx-injected: true"}],
+ opts: [adapter: adapter_opts]
+ )
+ )
+
+ assert worker_clients(origin.port) == %{}
+ refute_receive {:origin_request, "/final"}
+ assert {:ok, %Tesla.Env{status: 200, body: "ok"}} = request(origin.base_url <> "/final")
+ end
+
test "requests through authenticated SOCKS5 with proxy-side DNS", %{
origin: origin,
socks_proxy: proxy
@@ -622,12 +644,26 @@ defmodule Pleroma.HTTP.GunIntegrationTest do
end
defp worker_protocol(port) do
+ case worker_state(port) do
+ nil -> nil
+ state -> state.protocol
+ end
+ end
+
+ defp worker_clients(port) do
+ case worker_state(port) do
+ nil -> nil
+ state -> state.clients
+ end
+ end
+
+ defp worker_state(port) do
prefix = "https:127.0.0.1:#{port}:"
Pleroma.Gun.ConnectionPool
|> Registry.select([{{:"$1", :"$2", :_}, [], [{{:"$1", :"$2"}}]}])
|> Enum.find_value(fn {key, worker} ->
- if String.starts_with?(key, prefix), do: :sys.get_state(worker).protocol
+ if String.starts_with?(key, prefix), do: :sys.get_state(worker)
end)
end

File Metadata

Mime Type
text/x-diff
Expires
Sun, Jul 19, 10:10 AM (1 d, 19 h)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
1695241
Default Alt Text
(9 KB)

Event Timeline