From: Filippo Valsorda Date: Tue, 15 Jun 2021 11:13:08 +0000 (-0400) Subject: doc/go1.17: add security-related release notes X-Git-Tag: go1.17rc1~73 X-Git-Url: http://www.git.cypherpunks.su/?a=commitdiff_plain;h=85a2e24afd87d94c62f78672dc28c1991b2a271c;p=gostls13.git doc/go1.17: add security-related release notes Change-Id: I573def0f48fe66a1bc60fff321ab007c76b47ef0 Reviewed-on: https://go-review.googlesource.com/c/go/+/327810 Reviewed-by: Katie Hockman Trust: Katie Hockman Trust: Filippo Valsorda --- diff --git a/doc/go1.17.html b/doc/go1.17.html index 50559c8933..f1b3e3fdc7 100644 --- a/doc/go1.17.html +++ b/doc/go1.17.html @@ -441,6 +441,67 @@ func Foo() bool { runtime/cgo.Handle for more information.

+

URL query parsing

+ + +

+ The net/url and net/http packages used to accept + ";" (semicolon) as a setting separator in URL queries, in + addition to "&" (ampersand). Now, settings with non-percent-encoded + semicolons are rejected and net/http servers will log a warning to + Server.ErrorLog + when encountering one in a request URL. +

+ +

+ For example, before Go 1.17 the Query + method of the URL example?a=1;b=2&c=3 would have returned + map[a:[1] b:[2] c:[3]], while now it returns map[c:[3]]. +

+ +

+ When encountering such a query string, + URL.Query + and + Request.FormValue + ignore any settings that contain a semicolon, + ParseQuery + returns the remaining settings and an error, and + Request.ParseForm + and + Request.ParseMultipartForm + return an error but still set Request fields based on the + remaining settings. +

+ +

+ net/http users can restore the original behavior by using the new + AllowQuerySemicolons + handler wrapper. This will also suppress the ErrorLog warning. + Note that accepting semicolons as query separators can lead to security issues + if different systems interpret cache keys differently. + See issue 25192 for more information. +

+ +

TLS strict ALPN

+ + +

+ When Config.NextProtos + is set, servers now enforce that there is an overlap between the configured + protocols and the ALPN protocols advertised by the client, if any. If there is + no mutually supported protocol, the connection is closed with the + no_application_protocol alert, as required by RFC 7301. This + helps mitigate the ALPACA cross-protocol attack. +

+ +

+ As an exception, when the value "h2" is included in the server's + Config.NextProtos, HTTP/1.1 clients will be allowed to connect as + if they didn't support ALPN. + See issue 46310 for more information. +

+

Minor changes to the library

@@ -549,14 +610,6 @@ func Foo() bool { methods. Canceling the context after the handshake has finished has no effect.

-

- When Config.NextProtos - is set, servers now enforce that there is an overlap between the - configured protocols and the protocols advertised by the client, if any. - If there is no overlap the connection is closed with the - no_application_protocol alert, as required by RFC 7301. -

-

Cipher suite ordering is now handled entirely by the crypto/tls package. Currently, cipher suites are sorted based @@ -658,6 +711,22 @@ func Foo() bool { +

encoding/xml
+
+

+ When a comment appears within a + Directive, it is now replaced + with a single space instead of being completely elided. +

+ +

+ Invalid element or attribute names with leading, trailing, or multiple + colons are now stored unmodified into the + Name.Local field. +

+
+
+
flag

@@ -744,6 +813,20 @@ func Foo() bool {

+
mime/multipart
+
+

+ Part.FileName + now applies + filepath.Base to the + return value. This mitigates potential path traversal vulnerabilities in + applications that accept multipart messages, such as net/http + servers that call + Request.FormFile. +

+
+
+
net

@@ -763,7 +846,7 @@ func Foo() bool { the net.Error interface.

-

+

The ParseIP and ParseCIDR functions now reject IPv4 addresses which contain decimal components with leading zeros. @@ -794,6 +877,29 @@ func Foo() bool { The ReadRequest function now returns an error when the request has multiple Host headers.

+ +

+ When producing a redirect to the cleaned version of a URL, + ServeMux now always + uses relative URLs in the Location header. Previously it + would echo the full URL of the request, which could lead to unintended + redirects if the client could be made to send an absolute request URL. +

+ +

+ When interpreting certain HTTP headers handled by net/http, + non-ASCII characters are now ignored or rejected. +

+ +

+ If + Request.ParseForm + returns an error when called by + Request.ParseMultipartForm, + the latter now continues populating + Request.MultipartForm + before returning it. +