unofficial mirror of guix-patches@gnu.org 
 help / color / mirror / code / Atom feed
From: jlicht@fsfe.org
To: 59188@debbugs.gnu.org
Cc: Hilton Chain <hako@ultrarare.space>, Jelle Licht <jlicht@fsfe.org>
Subject: [bug#59188] [PATCH v3 14/16] gnu: llhttp-bootstrap: Update to 6.0.10.
Date: Wed,  8 Feb 2023 22:05:29 +0100	[thread overview]
Message-ID: <5074a5007a93e1e730f75f9a3ccdc3f4ae41d580.1675889756.git.jlicht@fsfe.org> (raw)
In-Reply-To: <cover.1675889756.git.jlicht@fsfe.org>

From: Hilton Chain <hako@ultrarare.space>

* gnu/packages/node.scm (llhttp-bootstrap): Update to 6.0.10.
* gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch: Remove file.
* gnu/local.mk: Remove it.
---
 gnu/local.mk                                  |   1 -
 gnu/packages/node.scm                         |   5 +-
 .../llhttp-bootstrap-CVE-2020-8287.patch      | 100 ------------------
 3 files changed, 2 insertions(+), 104 deletions(-)
 delete mode 100644 gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index a5f4b83961..60219dc756 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1482,7 +1482,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/linuxdcpp-openssl-1.1.patch		\
   %D%/packages/patches/lirc-localstatedir.patch			\
   %D%/packages/patches/lirc-reproducible-build.patch		\
-  %D%/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch	\
   %D%/packages/patches/llvm-3.5-fix-clang-build-with-gcc5.patch	\
   %D%/packages/patches/llvm-3.6-fix-build-with-gcc-10.patch	\
   %D%/packages/patches/llvm-3.x.1-fix-build-with-gcc.patch	\
diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index be39f3b25a..de847490a3 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -668,7 +668,7 @@ (define-public node-llparse-bootstrap
 (define-public llhttp-bootstrap
   (package
     (name "llhttp")
-    (version "2.1.4")
+    (version "6.0.10")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -677,8 +677,7 @@ (define-public llhttp-bootstrap
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "115mwyds9655p76lhglxg2blc1ksgrix6zhigaxnc2q6syy3pa6x"))
-              (patches (search-patches "llhttp-bootstrap-CVE-2020-8287.patch"))
+                "0izwqa77y007xdi0bj3ccw821n19rz89mz4hx4lg99fwkwylr6x8"))
               (modules '((guix build utils)))
               (snippet
                '(begin
diff --git a/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch b/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch
deleted file mode 100644
index 215c920e53..0000000000
--- a/gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-This patch comes from upstream.  It corresponds to a patch applied to
-the generated C source code for llhttp included in Node.js 14.16.0
-(see commit 641f786bb1a1f6eb1ff8750782ed939780f2b31a).  That commit
-fixes CVE-2020-8287.  With this patch, the output of our
-llhttp-bootstrap package matches the files included in Node.js 14.16.0
-exactly.
-
-commit e9b36ea64709c35ca66094d5cf3787f444029601
-Author: Fedor Indutny <fedor@indutny.com>
-Date:   Sat Oct 10 19:56:01 2020 -0700
-
-    http: unset `F_CHUNKED` on new `Transfer-Encoding`
-    
-    Duplicate `Transfer-Encoding` header should be a treated as a single,
-    but with original header values concatenated with a comma separator. In
-    the light of this, even if the past `Transfer-Encoding` ended with
-    `chunked`, we should be not let the `F_CHUNKED` to leak into the next
-    header, because mere presence of another header indicates that `chunked`
-    is not the last transfer-encoding token.
-
-diff --git a/src/llhttp/http.ts b/src/llhttp/http.ts
-index f4f1a6e..0a0c365 100644
---- a/src/llhttp/http.ts
-+++ b/src/llhttp/http.ts
-@@ -460,11 +460,19 @@ export class HTTP {
-       .match([ ' ', '\t' ], n('header_value_discard_ws'))
-       .otherwise(checkContentLengthEmptiness);
- 
-+    // Multiple `Transfer-Encoding` headers should be treated as one, but with
-+    // values separate by a comma.
-+    //
-+    // See: https://tools.ietf.org/html/rfc7230#section-3.2.2
-+    const toTransferEncoding = this.unsetFlag(
-+      FLAGS.CHUNKED,
-+      'header_value_te_chunked');
-+
-     n('header_value_start')
-       .otherwise(this.load('header_state', {
-         [HEADER_STATE.UPGRADE]: this.setFlag(FLAGS.UPGRADE, fallback),
-         [HEADER_STATE.TRANSFER_ENCODING]: this.setFlag(
--          FLAGS.TRANSFER_ENCODING, 'header_value_te_chunked'),
-+          FLAGS.TRANSFER_ENCODING, toTransferEncoding),
-         [HEADER_STATE.CONTENT_LENGTH]: n('header_value_content_length_once'),
-         [HEADER_STATE.CONNECTION]: n('header_value_connection'),
-       }, 'header_value'));
-@@ -847,6 +855,11 @@ export class HTTP {
-     return span.start(span.end(this.node(next)));
-   }
- 
-+  private unsetFlag(flag: FLAGS, next: string | Node): Node {
-+    const p = this.llparse;
-+    return p.invoke(p.code.and('flags', ~flag), this.node(next));
-+  }
-+
-   private setFlag(flag: FLAGS, next: string | Node): Node {
-     const p = this.llparse;
-     return p.invoke(p.code.or('flags', flag), this.node(next));
-diff --git a/test/request/transfer-encoding.md b/test/request/transfer-encoding.md
-index a7d1681..b0891d6 100644
---- a/test/request/transfer-encoding.md
-+++ b/test/request/transfer-encoding.md
-@@ -353,6 +353,38 @@ off=106 headers complete method=3 v=1/1 flags=200 content_length=0
- off=106 error code=15 reason="Request has invalid `Transfer-Encoding`"
- ```
- 
-+## POST with `chunked` and duplicate transfer-encoding
-+
-+<!-- meta={"type": "request", "noScan": true} -->
-+```http
-+POST /post_identity_body_world?q=search#hey HTTP/1.1
-+Accept: */*
-+Transfer-Encoding: chunked
-+Transfer-Encoding: deflate
-+
-+World
-+```
-+
-+```log
-+off=0 message begin
-+off=5 len=38 span[url]="/post_identity_body_world?q=search#hey"
-+off=44 url complete
-+off=54 len=6 span[header_field]="Accept"
-+off=61 header_field complete
-+off=62 len=3 span[header_value]="*/*"
-+off=67 header_value complete
-+off=67 len=17 span[header_field]="Transfer-Encoding"
-+off=85 header_field complete
-+off=86 len=7 span[header_value]="chunked"
-+off=95 header_value complete
-+off=95 len=17 span[header_field]="Transfer-Encoding"
-+off=113 header_field complete
-+off=114 len=7 span[header_value]="deflate"
-+off=123 header_value complete
-+off=125 headers complete method=3 v=1/1 flags=200 content_length=0
-+off=125 error code=15 reason="Request has invalid `Transfer-Encoding`"
-+```
-+
- ## POST with `chunked` before other transfer-coding (lenient)
- 
- TODO(indutny): should we allow it even in lenient mode? (Consider disabling
-- 
2.39.1





  parent reply	other threads:[~2023-02-08 21:47 UTC|newest]

Thread overview: 114+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-11-11  5:34 [bug#59188] [PATCH 0/4] gnu: node-lts: Update to 18.12.1 Hilton Chain via Guix-patches via
     [not found] ` <handler.59188.B.166814488314047.ack@debbugs.gnu.org>
2022-11-11  5:35   ` [bug#59188] [PATCH 1/4] gnu: libuv-for-node: Update to 1.43.0 Hilton Chain via Guix-patches via
2022-11-11  5:36     ` [bug#59188] [PATCH 2/4] gnu: llhttp-bootstrap: Update to 6.0.10 Hilton Chain via Guix-patches via
2022-11-11  5:37       ` [bug#59188] [PATCH 3/4] gnu: node-lts: Update to 18.12.1 Hilton Chain via Guix-patches via
2022-11-11  5:37         ` [bug#59188] [PATCH 4/4] gnu: libnode: Use node-lts as base Hilton Chain via Guix-patches via
2022-11-11  6:21 ` [bug#59188] [PATCH v2 0/4] gnu: node-lts: Update to 18.12.1 Hilton Chain via Guix-patches via
2022-11-11  6:22   ` [bug#59188] [PATCH v2 1/4] gnu: libuv-for-node: Update to 1.43.0 Hilton Chain via Guix-patches via
2022-11-11  6:22     ` [bug#59188] [PATCH v2 2/4] gnu: llhttp-bootstrap: Update to 6.0.10 Hilton Chain via Guix-patches via
2022-11-11  6:23       ` [bug#59188] [PATCH v2 3/4] gnu: node-lts: Update to 18.12.1 Hilton Chain via Guix-patches via
2022-11-11  6:24         ` [bug#59188] [PATCH v2 4/4] gnu: libnode: Use node-lts as base Hilton Chain via Guix-patches via
2022-11-16 23:31         ` [bug#59188] [PATCH v2 3/4] gnu: node-lts: Update to 18.12.1 Mekeor Melire
2022-11-18 14:12           ` [bug#59188] [PATCH 0/4] " Ludovic Courtès
2022-11-19  5:17             ` Hilton Chain via Guix-patches via
2023-01-05 13:10               ` Jelle Licht
2022-11-20  9:40             ` Christopher Baines
2023-02-06 13:37 ` [bug#59188] node-lts 18: progress? Dr. Arne Babenhauserheide
2023-02-08 21:05 ` [bug#59188] [PATCH v3 00/16] Updating node-lts to 18.X jlicht
2023-02-08 21:05   ` [bug#59188] [PATCH v3 01/16] gnu: node-acorn: Disable tests jlicht
2023-02-08 21:05   ` [bug#59188] [PATCH v3 02/16] gnu: node-acorn: Remove lifecycle script jlicht
2023-02-08 21:05   ` [bug#59188] [PATCH v3 03/16] gnu: node-acorn: Fix broken transpilation jlicht
2023-02-08 21:05   ` [bug#59188] [PATCH v3 04/16] gnu: node-buffer-crc32: Ignore development dependencies jlicht
2023-02-08 21:05   ` [bug#59188] [PATCH v3 05/16] gnu: node-crx3: " jlicht
2023-02-08 21:05   ` [bug#59188] [PATCH v3 06/16] gnu: node-minimist: " jlicht
2023-02-08 21:05   ` [bug#59188] [PATCH v3 07/16] gnu: node-pbf: " jlicht
2023-02-08 21:05   ` [bug#59188] [PATCH v3 08/16] gnu: node-protocol-buffers-schema: " jlicht
2023-02-08 21:05   ` [bug#59188] [PATCH v3 09/16] gnu: node-resolve-protobuf-schema: " jlicht
2023-02-08 21:05   ` [bug#59188] [PATCH v3 10/16] gnu: node-ieee754: " jlicht
2023-02-08 21:05   ` [bug#59188] [PATCH v3 11/16] gnu: node-yazl: " jlicht
2023-02-08 21:05   ` [bug#59188] [PATCH v3 12/16] gnu: node-uglify-js: Update to 3.14.2 jlicht
2023-02-08 21:05   ` [bug#59188] [PATCH v3 13/16] gnu: libuv-for-node: Update to 1.44.2 jlicht
2023-02-08 21:05   ` jlicht [this message]
2023-02-08 21:05   ` [bug#59188] [PATCH v3 15/16] gnu: node-lts: Update to 18.14.0 jlicht
2023-02-08 21:05   ` [bug#59188] [PATCH v3 16/16] gnu: libnode: Use node-lts as base jlicht
2023-03-02 22:53 ` [bug#59188] [PATCH v4 00/16] Updating node-lts to 18.X jlicht
2023-03-02 22:53   ` [bug#59188] [PATCH v4 01/16] gnu: node-acorn: Disable tests jlicht
2023-03-02 22:53   ` [bug#59188] [PATCH v4 02/16] gnu: node-acorn: Remove lifecycle script jlicht
2023-03-02 22:53   ` [bug#59188] [PATCH v4 03/16] gnu: node-acorn: Fix broken transpilation jlicht
2023-03-02 22:53   ` [bug#59188] [PATCH v4 04/16] gnu: node-buffer-crc32: Ignore development dependencies jlicht
2023-03-02 22:53   ` [bug#59188] [PATCH v4 05/16] gnu: node-crx3: " jlicht
2023-03-02 22:53   ` [bug#59188] [PATCH v4 06/16] gnu: node-minimist: " jlicht
2023-03-02 22:53   ` [bug#59188] [PATCH v4 07/16] gnu: node-pbf: " jlicht
2023-03-02 22:53   ` [bug#59188] [PATCH v4 08/16] gnu: node-protocol-buffers-schema: " jlicht
2023-03-02 22:53   ` [bug#59188] [PATCH v4 09/16] gnu: node-resolve-protobuf-schema: " jlicht
2023-03-02 22:53   ` [bug#59188] [PATCH v4 10/16] gnu: node-ieee754: " jlicht
2023-03-02 22:53   ` [bug#59188] [PATCH v4 11/16] gnu: node-yazl: " jlicht
2023-03-02 22:53   ` [bug#59188] [PATCH v4 12/16] gnu: node-uglify-js: Update to 3.14.2 jlicht
2023-03-02 22:53   ` [bug#59188] [PATCH v4 13/16] gnu: libuv-for-node: Update to 1.44.2 jlicht
2023-03-02 22:53   ` [bug#59188] [PATCH v4 14/16] gnu: llhttp-bootstrap: Update to 6.0.10 jlicht
2023-03-02 22:53   ` [bug#59188] [PATCH v4 15/16] gnu: node-lts: Update to 18.14.2 jlicht
2023-03-02 22:53   ` [bug#59188] [PATCH v4 16/16] gnu: libnode: Use node-lts as base jlicht
2023-03-15  0:55 ` [bug#59188] [PATCH v5 00/17] Updating node-lts to 18.X jlicht
2023-03-15  0:55   ` [bug#59188] [PATCH v5 01/17] build-system: node: Use `--install-links' with `npm install' jlicht
2023-03-15  0:55   ` [bug#59188] [PATCH v5 02/17] gnu: node-acorn: Disable tests jlicht
2023-03-15  0:55   ` [bug#59188] [PATCH v5 03/17] gnu: node-acorn: Remove lifecycle script jlicht
2023-03-15  0:55   ` [bug#59188] [PATCH v5 04/17] gnu: node-acorn: Fix broken transpilation jlicht
2023-03-15  0:55   ` [bug#59188] [PATCH v5 05/17] gnu: node-buffer-crc32: Ignore development dependencies jlicht
2023-03-15  0:55   ` [bug#59188] [PATCH v5 06/17] gnu: node-crx3: " jlicht
2023-03-15  0:55   ` [bug#59188] [PATCH v5 07/17] gnu: node-minimist: " jlicht
2023-03-15  0:55   ` [bug#59188] [PATCH v5 08/17] gnu: node-pbf: " jlicht
2023-03-15  0:55   ` [bug#59188] [PATCH v5 09/17] gnu: node-protocol-buffers-schema: " jlicht
2023-03-15  0:55   ` [bug#59188] [PATCH v5 10/17] gnu: node-resolve-protobuf-schema: " jlicht
2023-03-15  0:55   ` [bug#59188] [PATCH v5 11/17] gnu: node-ieee754: " jlicht
2023-03-15  0:55   ` [bug#59188] [PATCH v5 12/17] gnu: node-yazl: " jlicht
2023-03-15  0:55   ` [bug#59188] [PATCH v5 13/17] gnu: node-uglify-js: Update to 3.14.2 jlicht
2023-03-15  0:55   ` [bug#59188] [PATCH v5 14/17] gnu: libuv-for-node: Update to 1.44.2 jlicht
2023-03-15  0:55   ` [bug#59188] [PATCH v5 15/17] gnu: llhttp-bootstrap: Update to 6.0.10 jlicht
2023-03-15  0:55   ` [bug#59188] [PATCH v5 16/17] gnu: node-lts: Update to 18.15.0 jlicht
2023-03-15  0:55   ` [bug#59188] [PATCH v5 17/17] gnu: libnode: Use node-lts as base jlicht
2023-03-30 12:31 ` [bug#59188] [PATCH v6 00/19] Updating node-lts to 18.X jlicht
2023-03-30 12:31   ` [bug#59188] [PATCH v6 01/19] build-system: node: Use `--install-links' with `npm install' jlicht
2023-03-30 12:31   ` [bug#59188] [PATCH v6 02/19] gnu: node-acorn: Disable tests jlicht
2023-03-30 12:31   ` [bug#59188] [PATCH v6 03/19] gnu: node-acorn: Remove lifecycle script jlicht
2023-03-30 12:31   ` [bug#59188] [PATCH v6 04/19] gnu: node-acorn: Fix broken transpilation jlicht
2023-03-30 12:31   ` [bug#59188] [PATCH v6 05/19] gnu: node-buffer-crc32: Ignore development dependencies jlicht
2023-03-30 12:31   ` [bug#59188] [PATCH v6 06/19] gnu: node-crx3: " jlicht
2023-03-30 12:31   ` [bug#59188] [PATCH v6 07/19] gnu: node-minimist: " jlicht
2023-03-30 12:31   ` [bug#59188] [PATCH v6 08/19] gnu: node-pbf: " jlicht
2023-03-30 12:31   ` [bug#59188] [PATCH v6 09/19] gnu: node-protocol-buffers-schema: " jlicht
2023-03-30 12:31   ` [bug#59188] [PATCH v6 10/19] gnu: node-resolve-protobuf-schema: " jlicht
2023-03-30 12:31   ` [bug#59188] [PATCH v6 11/19] gnu: node-ieee754: " jlicht
2023-03-30 12:31   ` [bug#59188] [PATCH v6 12/19] gnu: node-yazl: " jlicht
2023-03-30 12:31   ` [bug#59188] [PATCH v6 13/19] gnu: node-uglify-js: Update to 3.14.2 jlicht
2023-03-30 12:31   ` [bug#59188] [PATCH v6 14/19] gnu: node-serialport: Avoid gyp rebuilds jlicht
2023-03-30 12:31   ` [bug#59188] [PATCH v6 15/19] gnu: node-openzwave-shared: Fix compilation for new versions of node jlicht
2023-03-30 12:31   ` [bug#59188] [PATCH v6 16/19] gnu: libuv-for-node: Update to 1.44.2 jlicht
2023-03-30 12:31   ` [bug#59188] [PATCH v6 17/19] gnu: llhttp-bootstrap: Update to 6.0.10 jlicht
2023-03-30 12:31   ` [bug#59188] [PATCH v6 18/19] gnu: node-lts: Update to 18.15.0 jlicht
2023-03-30 12:31   ` [bug#59188] [PATCH v6 19/19] gnu: libnode: Use node-lts as base jlicht
2023-04-13 15:55   ` [bug#59188] [PATCH v6 00/19] Updating node-lts to 18.X Leo Famulari
2023-04-17 14:51 ` [bug#59188] [PATCH v7 00/20] " jlicht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 01/20] build-system: node: Use `--install-links' with `npm install' jlicht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 02/20] gnu: node-acorn: Disable tests jlicht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 03/20] gnu: node-acorn: Remove lifecycle script jlicht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 04/20] gnu: node-acorn: Fix broken transpilation jlicht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 05/20] gnu: node-buffer-crc32: Ignore development dependencies jlicht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 06/20] gnu: node-crx3: " jlicht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 07/20] gnu: node-minimist: " jlicht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 08/20] gnu: node-pbf: " jlicht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 09/20] gnu: node-protocol-buffers-schema: " jlicht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 10/20] gnu: node-resolve-protobuf-schema: " jlicht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 11/20] gnu: node-ieee754: " jlicht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 12/20] gnu: node-yazl: " jlicht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 13/20] gnu: node-uglify-js: Update to 3.14.2 jlicht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 14/20] gnu: node-serialport: Avoid gyp rebuilds jlicht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 15/20] gnu: node-openzwave-shared: Fix compilation for new versions of node jlicht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 16/20] gnu: emacs-nodejs-repl: Build with node-lts jlicht
2023-04-17 15:37     ` Liliana Marie Prikler
2023-04-17 16:03       ` Jelle Licht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 17/20] gnu: libuv-for-node: Update to 1.44.2 jlicht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 18/20] gnu: llhttp-bootstrap: Update to 6.0.10 jlicht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 19/20] gnu: node-lts: Update to 18.16.0 jlicht
2023-04-17 14:51   ` [bug#59188] [PATCH v7 20/20] gnu: libnode: Use node-lts as base jlicht
2023-04-17 22:08   ` [bug#59188] [PATCH v7 00/20] Updating node-lts to 18.X Mekeor Melire
2023-05-06 12:50 ` bug#59188: " Jelle Licht

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://guix.gnu.org/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=5074a5007a93e1e730f75f9a3ccdc3f4ae41d580.1675889756.git.jlicht@fsfe.org \
    --to=jlicht@fsfe.org \
    --cc=59188@debbugs.gnu.org \
    --cc=hako@ultrarare.space \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).