1
0
Fork 0
mirror of https://github.com/denoland/deno.git synced 2025-01-14 10:01:51 -05:00
denoland-deno/std
Andrew Stucki 1e478d73e3
Drop headers with trailing whitespace in header name (#4642)
This relates directly to [an
issue](https://github.com/denoland/deno_std/issues/620) that I initially
raised in `deno_std` awhile back, and was reminded about it today when
the `oak` project popped up on my github recommended repos.

As of now Deno's http servers are vulnerable to the same underlying
issue of go CVE-2019-16276 due to the fact that it's based off of ported
go code from their old standard library. [Here's the commit that fixed
the
CVE.](6e6f4aaf70)

Long story short, some off the shelf proxies and caching servers allow
for passing unaltered malformed headers to backends that they're
fronting. When they pass invalid headers that they don't understand this
can cause issues with HTTP request smuggling. I believe that to this
date, this is the default behavior of AWS ALBs--meaning any server that
strips whitespace from the tail end of header field names and then
interprets the header, when placed behind an ALB, is susceptible to
request smuggling.

The current behavior is actually specifically called out in [RFC
7230](https://tools.ietf.org/html/rfc7230#section-3.2.4) as something
that MUST result in a rejected message, but the change corresponding to
this PR, is more lenient and what both go and nginx currently do, and is
better than the current behavior.
2020-04-06 09:58:46 -04:00
..
archive Move encode, decode helpers to /std/encoding/utf8.ts, delete /std/strings/ (#4565) 2020-04-01 15:23:39 -04:00
bytes Move encode, decode helpers to /std/encoding/utf8.ts, delete /std/strings/ (#4565) 2020-04-01 15:23:39 -04:00
datetime used native padStart/End where possible (#4537) 2020-03-31 12:34:13 +02:00
encoding Move encode, decode helpers to /std/encoding/utf8.ts, delete /std/strings/ (#4565) 2020-04-01 15:23:39 -04:00
examples Move encode, decode helpers to /std/encoding/utf8.ts, delete /std/strings/ (#4565) 2020-04-01 15:23:39 -04:00
flags feat(std/flags): pass key and value to unknown (#4637) 2020-04-06 09:27:10 -04:00
fmt Update to Prettier 2 and use ES Private Fields (#4498) 2020-03-28 13:03:49 -04:00
fs fix erroneous assert (#4608) 2020-04-03 13:49:05 -04:00
http Remove /std/media_types (#4594) 2020-04-03 12:11:52 -04:00
io Move encode, decode helpers to /std/encoding/utf8.ts, delete /std/strings/ (#4565) 2020-04-01 15:23:39 -04:00
log Update to Prettier 2 and use ES Private Fields (#4498) 2020-03-28 13:03:49 -04:00
mime Move encode, decode helpers to /std/encoding/utf8.ts, delete /std/strings/ (#4565) 2020-04-01 15:23:39 -04:00
node Update to Prettier 2 and use ES Private Fields (#4498) 2020-03-28 13:03:49 -04:00
path feat: Add common to std/path (#4527) 2020-03-30 11:36:55 -04:00
permissions Update to Prettier 2 and use ES Private Fields (#4498) 2020-03-28 13:03:49 -04:00
signal Update to Prettier 2 and use ES Private Fields (#4498) 2020-03-28 13:03:49 -04:00
testing fix(std/testing): formatting bigint (#4626) 2020-04-04 13:13:37 -04:00
textproto Drop headers with trailing whitespace in header name (#4642) 2020-04-06 09:58:46 -04:00
types Update to Prettier 2 and use ES Private Fields (#4498) 2020-03-28 13:03:49 -04:00
util Update to Prettier 2 and use ES Private Fields (#4498) 2020-03-28 13:03:49 -04:00
uuid Update to Prettier 2 and use ES Private Fields (#4498) 2020-03-28 13:03:49 -04:00
ws Move encode, decode helpers to /std/encoding/utf8.ts, delete /std/strings/ (#4565) 2020-04-01 15:23:39 -04:00
manual.md doc: Fix some typos and improve a few sentences in the std manual (#4522) 2020-03-29 22:23:57 -04:00
README.md feat: dprint formatter (#3820) 2020-01-29 21:16:48 -05:00
style_guide.md doc: Improve the style guide (#4627) 2020-04-04 13:11:43 -04:00

Deno Standard Modules

These modules do not have external dependencies and they are reviewed by the Deno core team. The intention is to have a standard set of high quality code that all Deno projects can use fearlessly.

Contributions are welcome!

How to use

These modules are tagged in accordance with Deno releases. So, for example, the v0.3.0 tag is guaranteed to work with deno v0.3.0. You can link to v0.3.0 using the URL https://deno.land/std@v0.3.0/

It's strongly recommended that you link to tagged releases rather than the master branch. The project is still young and we expect disruptive renames in the future.

Documentation

Here are the dedicated documentations of modules:

Contributing

deno_std is a loose port of Go's standard library. When in doubt, simply port Go's source code, documentation, and tests. There are many times when the nature of JavaScript, TypeScript, or Deno itself justifies diverging from Go, but if possible we want to leverage the energy that went into building Go. We generally welcome direct ports of Go's code.

Please ensure the copyright headers cite the code's origin.

Follow the style guide.