Skip to content

security: fix URL truncation issue#144

Merged
fantix merged 1 commit into
masterfrom
t142-url-truncation
May 25, 2026
Merged

security: fix URL truncation issue#144
fantix merged 1 commit into
masterfrom
t142-url-truncation

Conversation

@fantix
Copy link
Copy Markdown
Member

@fantix fantix commented May 25, 2026

Fixes #142

@fantix
Copy link
Copy Markdown
Member Author

fantix commented May 25, 2026

@Kludex I feel like this would be an acceptable patch to stop the bleeding for now? (In the long run, we should migrate away from the no-longer-maintained http-parser and land one of the Rust approaches)

@Kludex
Copy link
Copy Markdown
Contributor

Kludex commented May 25, 2026

Yes, this is enough.

Thanks so much! 🙏

@fantix fantix merged commit a0283f0 into master May 25, 2026
19 checks passed
@fantix fantix deleted the t142-url-truncation branch May 25, 2026 21:38
@fantix fantix mentioned this pull request May 25, 2026
pull Bot pushed a commit to sysfce2/python-httptools that referenced this pull request May 25, 2026
Changes
=======

* Add http-parser and llhttp licenses into the wheels (MagicStack#135)
  (by @justeph in c398a15)

* Mark cython module as free-threading compatible (MagicStack#139)
  (by @kumaraditya303 in 28d1db1)

* Fix all typing issues (MagicStack#134)
  (by @Kludex in a9bda0e)

* Bump llhttp to 9.4.1 (MagicStack#145)
  (by @fantix in e3e8d71)

* Security: fix URL truncation issue (MagicStack#144)
  (by @fantix in a0283f0 for MagicStack#142)

* Allow building with latest setuptools (MagicStack#138)
  (by @OldManYellsAtCloud in c403ad1)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Security: parse_url() truncates oversized URL fields due to uint16_t offsets/lengths in vendored http-parser

2 participants