pkgsrc-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: [pkgsrc-2026Q3] pkgsrc/www/p5-HTTP-Body
Module Name: pkgsrc
Committed By: maya
Date: Wed Nov 11 10:02:13 UTC 2026
Modified Files:
pkgsrc/www/p5-HTTP-Body [pkgsrc-2026Q3]: Makefile distinfo
Log Message:
Pullup ticket #7354 - requested by taca
www/p5-HTTP-Body: Security fix
Revisions pulled up:
- www/p5-HTTP-Body/Makefile 1.34-1.35
- www/p5-HTTP-Body/distinfo 1.16-1.17
---
Module Name: pkgsrc
Committed By: wiz
Date: Wed Oct 28 21:57:07 UTC 2026
Modified Files:
pkgsrc/www/p5-HTTP-Body: Makefile distinfo
Log Message:
p5-HTTP-Body: update to 1.24.
1.24 2026-10-26 18:28:01+01:00 Europe/Berlin
- SECURITY, CVE-2026-116131: urlencoded bodies are limited to
$HTTP::Body::UrlEncoded::max_params fields and multipart bodies to
$HTTP::Body::MultiPart::max_parts parts (1000 each); reported and
patched by CPANSec
- SECURITY, CVE-2026-116132: the temporary file of an upload that is
still incomplete at DESTROY-time is now always deleted; reported and
patched by CPANSec (also fixes RT#84004)
- SECURITY, CVE-2026-116133: a multipart body without a boundary or with
a malformed delimiter line no longer takes quadratic time; a malformed
delimiter line now croaks, and padding or an epilogue after the close
delimiter is accepted; reported and patched by CPANSec
- SECURITY, CVE-2026-116134: a multipart part's header block is limited
to $HTTP::Body::MultiPart::max_header_size bytes (32768) and
$HTTP::Body::MultiPart::max_header_lines lines (100); reported and
patched by CPANSec
- SECURITY, CVE-2026-116135: mixed-case percent escapes (e.g. %aB) in
urlencoded bodies are decoded instead of being dropped; reported and
patched by CPANSec
- SECURITY, CVE-2026-116285: the chunk size line of a chunked body is
matched in linear instead of quadratic time
- SECURITY, CVE-2026-116531: a chunked body is now framed independently
of where the reads feeding add() fall; a read that split a chunk could
leave the parser never reaching 'done', hanging a server that reads
until done
- INCOMPATIBLE: add() now croaks when one of the new limits is exceeded.
Raise the variable, or set it to 0 to disable that limit, if your
forms need more. See NOTES in HTTP::Body.
- RT#105021: temp-file write errors in MultiPart and OctetStream now
croak instead of silently truncating the stored body
- RT#123615: a NUL byte in a multipart filename is stripped so it cannot
truncate a path handed on downstream
- Moved repository from Shadowcat git to GitHub (libwww-perl/HTTP-Body)
- Updated all metadata resources to point to GitHub
- Fixed prerequisites: moved Digest::MD5 to test deps, changed HTTP::Headers to HTTP::Message
- Added README.md for GitHub
- Updated support section in documentation
- Moved the POD, POD coverage and Perl::Critic tests to xt/release, so
they run on every release instead of being skipped
---
Module Name: pkgsrc
Committed By: wiz
Date: Fri Nov 6 17:22:00 UTC 2026
Modified Files:
pkgsrc/www/p5-HTTP-Body: Makefile distinfo
Log Message:
p5-HTTP-Body: update to 1.25.
TOOL_DEPENDS -> TEST_DEPENDS for a test dependency.
1.25 2026-11-05 18:47:08+01:00 Europe/Berlin
- SECURITY, CVE-2026-117500: the suffix of an upload's filename is
worked out from its last 255 bytes only, only when $file_temp_suffix
is unset, and for the default $basename_regexp by a string search
instead of the regexp; a filename of many dots ending in a backslash
made the default $basename_regexp take time quadratic in its length
(7 s per part at the 32 KiB header limit, once per part) in the
default configuration
- SECURITY, CVE-2026-117501: a chunked body is framed line by line with
a limit on the chunk-size line ($HTTP::Body::max_chunk_line_size,
1024 bytes), chunk data is passed on as it arrives instead of being
held until the chunk is complete, malformed framing (a line that is
no chunk-size line, a size that does not fit an integer, chunk data
not followed by CRLF) croaks instead of buffering forever, and
nothing after the trailer or after the body parser is done is kept
- SECURITY, CVE-2026-121006: the trailer of a chunked body is limited
to $HTTP::Body::max_trailer_size bytes (32768) and
$HTTP::Body::max_trailer_lines header lines (100); everything that
followed the last chunk in the same call to add() was parsed with
HTTP::Headers, which takes time quadratic in the number of fields of
one name (6 s for 16 KiB of "a:" lines)
- trailing_headers: a trailer is read up to its blank line also when it
arrives in later calls to add() than the last chunk; it used to be
lost
- XFormsMultipart: a part other than the start part now gets its
temporary file and the NUL strip of RT#123615 like any upload; it used
to be returned by upload without a tempname, its data dropped
- parse_header: a continuation line at the start of a part's header
block is dropped instead of dying, and a line that is no header field
is dropped instead of being stored under a made-up field name
- add: the caller's buffer is no longer modified in place when it
exceeds the Content-Length, so a read-only value is accepted
- Docs: every method of the parser classes is described, add and
length say what they return; the README lists every limit,
$basename_regexp and all runtime prerequisites
- File::Spec is declared as a prerequisite
To generate a diff of this commit:
cvs rdiff -u -r1.33 -r1.33.2.1 pkgsrc/www/p5-HTTP-Body/Makefile
cvs rdiff -u -r1.15 -r1.15.20.1 pkgsrc/www/p5-HTTP-Body/distinfo
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: pkgsrc/www/p5-HTTP-Body/Makefile
diff -u pkgsrc/www/p5-HTTP-Body/Makefile:1.33 pkgsrc/www/p5-HTTP-Body/Makefile:1.33.2.1
--- pkgsrc/www/p5-HTTP-Body/Makefile:1.33 Thu Jul 16 19:06:00 2026
+++ pkgsrc/www/p5-HTTP-Body/Makefile Wed Nov 11 10:02:12 2026
@@ -1,18 +1,17 @@
-# $NetBSD: Makefile,v 1.33 2026/07/16 19:06:00 wiz Exp $
+# $NetBSD: Makefile,v 1.33.2.1 2026/11/11 10:02:12 maya Exp $
-DISTNAME= HTTP-Body-1.23
+DISTNAME= HTTP-Body-1.25
PKGNAME= p5-${DISTNAME}
-PKGREVISION= 3
CATEGORIES= www perl5
-MASTER_SITES= ${MASTER_SITE_PERL_CPAN:=HTTP/}
+MASTER_SITES= ${MASTER_SITE_PERL_CPAN:=../../authors/id/G/GE/GETTY/}
MAINTAINER= pkgsrc-users%NetBSD.org@localhost
HOMEPAGE= https://metacpan.org/release/HTTP-Body
COMMENT= HTTP Body Parser
LICENSE= ${PERL5_LICENSE}
-TOOL_DEPENDS+= p5-Test-Deep-[0-9]*:../../devel/p5-Test-Deep
DEPENDS+= p5-HTTP-Message>=0:../../www/p5-HTTP-Message
+TEST_DEPENDS+= p5-Test-Deep-[0-9]*:../../devel/p5-Test-Deep
USE_LANGUAGES= # empty
PERL5_PACKLIST= auto/HTTP/Body/.packlist
Index: pkgsrc/www/p5-HTTP-Body/distinfo
diff -u pkgsrc/www/p5-HTTP-Body/distinfo:1.15 pkgsrc/www/p5-HTTP-Body/distinfo:1.15.20.1
--- pkgsrc/www/p5-HTTP-Body/distinfo:1.15 Sun Apr 7 21:34:46 2024
+++ pkgsrc/www/p5-HTTP-Body/distinfo Wed Nov 11 10:02:12 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.15 2024/04/07 21:34:46 wiz Exp $
+$NetBSD: distinfo,v 1.15.20.1 2026/11/11 10:02:12 maya Exp $
-BLAKE2s (HTTP-Body-1.23.tar.gz) = e72277d3252a69ec1b96b5b178e111ea39263ab8ff20a0d3c070d60545ede58a
-SHA512 (HTTP-Body-1.23.tar.gz) = b02fb8652ceebdaa858ff12fe759ded62eefa7f23e5bf8b90e31a52d4433f13d29986f9646141b92a6a4ea58e1be007c6f675c3e2b26559fa0ff9333e69f3ebb
-Size (HTTP-Body-1.23.tar.gz) = 26980 bytes
+BLAKE2s (HTTP-Body-1.25.tar.gz) = 42926d965d3c0d94f3061ef693189c398ffc62dfa87040069ef7d4619254d247
+SHA512 (HTTP-Body-1.25.tar.gz) = 68df3cb79b201a218b78e41946df03237a2a787eb532fea8dd3757350b76e2f251f843f5c93c40c753f6a72e09a7a770c715cd7f85252abb8b17b341e25f47fd
+Size (HTTP-Body-1.25.tar.gz) = 43123 bytes
Home |
Main Index |
Thread Index |
Old Index