summaryrefslogtreecommitdiff
path: root/libsoup
Commit message (Collapse)AuthorAgeFilesLines
* meson: Override deps for use by the provide wrap sectionNirbheek Chauhan2022-03-251-0/+12
| | | | See: https://mesonbuild.com/Wrap-dependency-system-manual.html#provide-section
* Also fix missing extern on 2-27 branchMelroy van den Berg2022-02-271-1/+1
|
* Add two missing (out) g-i annotationsRico Tzschichholz2022-02-032-2/+2
|
* Error when libsoup3 is detected as already loaded in the same processPatrick Griffis2021-11-171-0/+19
| | | | | | Companion to 9596a869414bb0811f1e1f6009c950ca7af81189 See !211
* Add missing BEGIN/END DECLS to soup-proxy-resolver-default.hPatrick Griffis2021-10-111-0/+4
| | | | Closes #242
* meson: Use an gssapi as a proper dependencyNirbheek Chauhan2021-10-091-1/+2
| | | | | There is no need to add it to the project arguments; we should treat it as any other dependency. There's nothing special about it.
* vala: Better fix for #234 supporting older valaRico Tzschichholz2021-09-022-4/+2
| | | | Closes #237
* docs: Refer to 2.74.0 for ssl changesPatrick Griffis2021-08-221-2/+2
| | | | In the end 2.72.1 wasn't released.
* Improve support for rfc 7230gnome-3-38Ignacio Casal Quinteiro2021-08-081-1/+10
| | | | | A server MUST NOT send a Content-Length header field in any response with a status code of 1xx (Informational) or 204 (No Content)
* Fix building vapi generation with latest valaPatrick Griffis2021-08-071-0/+4
| | | | Closes #234
* Fix bad rebase in 4bbc39f30a48e38d7c60a375a88d2a2e6a41a0b8Patrick Griffis2021-07-241-1/+1
|
* headers: Fix parsing of Content-TypePatrick Griffis2021-07-241-1/+2
| | | | | | | With d9f97292 the intention was only to change the behavior of soup_message_headers_get_content_disposition() however parse_content_foo() is also used for Content-Type. Fixes #232
* headers: Support invalid content-disposition without disposition-typePatrick Griffis2021-07-151-15/+25
|
* Enable ssl-use-system-ca-file on deprecated Sync and Async sessionsPatrick Griffis2021-06-241-9/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The default was disabled for backwards compatability however it was an unsafe default and many projects unknowingly did not enable it. This is a break in behavior however the security concerns are important. The belief that all projects would switch to the safer SoupSession didn't happen and the number of under-maintained projects is too many to fix quickly. This brings a base level of security to all of them and will likely not actually break much as the modern internet depends on CAs heavily. For users who are broken by it, the possible fixes are: - Add the CA for the service you can no longer connect to to the system CA database on your computer - Get the administrator of the service you were connecting to to switch to using a certificate signed by a public CA - Use http rather than https - Wait for, or request, the app to be updated For system administrators who provide a service whose users have been broken by this, the possible fixes are: - Update your service to use a certificate signed by a public CA - Get each user to add the CA to their system CA db, as above - Get each user to move to an alternative app For developers of apps whose users have been broken by this, the possible fixes are: - Document how users can add CAs to the system CA DB, as above - Add a config option to allow users to turn ssl-use-system-ca-file off again. (Note that this will probably eventually result in someone filing a CVE against your app.) - Add a config option to allow users to configure a file containing a CA to be trusted, and then read that in as a GTlsDatabaseFile and set it as SoupSession:tls-database - Add a ton of code to allow users to accept certificates signed by unknown CAs and then remember the certificates for next time. (We have no easily-copied examples of how to do this.)
* Remove extern "C" wrapping other includesPatrick Griffis2021-04-271-8/+0
| | | | | This isn't the proper way to use extern C as the included headers may actually have C++ aware code in them.
* Fix leaks found by Coverity ScanMilan Crha2021-03-172-0/+2
| | | | Closes #217
* soup-uri: Don't attempt to resolve relative paths in data URLsRyan Gonzalez2021-03-081-0/+5
| | | | | | | RFC2397 states that data URLs have "no relative URL forms", but soup_uri_new_with_base would still attempt to resolve any suspected relative URL paths regardless. This was also inconsistent with the behavior of most web browsers.
* Fix runtime critical when message is cancelled after a failed authcarlosgc/auth-retry-cancelCarlos Garcia Campos2020-09-101-1/+2
| | | | | | | | | | | | When the message is restarted due to the failed auth, we fail to properly reset the SoupSession:ostream data on the item task and we end up calling async_send_request_return_result() twice causing the following critical the second time: (auth-test:66750): libsoup-CRITICAL **: 15:48:08.156: async_send_request_return_result: assertion 'item->task != NULL' failed SoupSession:ostream data is set in item task, but we reset in item message.
* soup-brotli-decompressor.h: remove superfluous get_type declarationTom Schoonjans2020-08-031-3/+0
| | | | | | This fixes compilation with Visual Studio, as the explicit declaration of soup_brotli_decompressor_get_type and the one generated by G_DECLARE_FINAL_TYPE are apparently not identical for the cl.exe compiler.
* soup-message-io: Add sysprof profiling support for HTTP connectionsPhilip Withnall2020-07-272-0/+40
| | | | | | | | | | | | | | | | | This adds very basic support for dumping HTTP connection information to sysprof, if the process is being run under a sysprof session. See https://gitlab.gnome.org/GNOME/sysprof/-/issues/43 for plans of how this could be expanded in future. This is just a starting point. The code in this commit dumps a message to the sysprof capture which includes the URI, total time for the connection (request + response), and the amount of data transferred in the request and response. It adds an optional dependency on `libsysprof-capture-4.a`, and a subproject for building that if it’s not available on the system. Signed-off-by: Philip Withnall <withnall@endlessm.com>
* soup-session: Add support for status code 308 Permanent RedirectBenjamin Kaufmann2020-07-192-0/+2
|
* soup-message: make soup_message_disables_feature_by_type() publicCarlos Garcia Campos2020-07-065-4/+27
| | | | | Renamed as soup_message_is_feature_disabled(). We need this in WebKit to check if cookies are available in an existing SoupMessage.
* soup-message: Use a hash set to store disabled featuresCarlos Garcia Campos2020-07-063-18/+32
| | | | | This way disabling the same feature twice doesn't add a new element to the list.
* soup-session: soup_session_has_feature doesn't work for requestsCarlos Garcia Campos2020-07-061-2/+15
| | | | | | | We are currently using the hash table value as a key in the lookup. So, we compare the feature type with the registewred schemes. We should get the list of schemes and find one in the table whose value matches the given type.
* soup-cookie-jar: Add SOUP_COOKIE_JAR_ACCEPT_GRANDFATHERED_THIRD_PARTYCarlos Garcia Campos2020-07-062-14/+51
| | | | | | | | | | | | This new policy matches the Safari behavior when ITP is disabled and third-party cookies are blocked. The SOUP_COOKIE_JAR_ACCEPT_NO_THIRD_PARTY policy does not allow subresources to set cookies unless they match the domain of the main resource. The new policy makes an exception for domains that have previously stored cookies (when being visited). This patch was written by Michael Catanzaro, but it changed the behavior of SOUP_COOKIE_JAR_ACCEPT_NO_THIRD_PARTY. I just updated it to add a new policy instead.
* soup-uri: Check string lengths before reading bytes of %-encoded charsPhilip Withnall2020-07-021-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | There are two instances in `SoupURI` where `g_ascii_isxdigit()` is called two bytes ahead of the read pointer to check if a %-encoding is valid. This is fine when the string being parsed is nul-terminated (as the first `g_ascii_isxdigit()` call will safely return `FALSE`), but will result in a read off the end of the buffer if it’s length-terminated (and doesn’t happen to also be nul-terminated). Thankfully, that’s not the case in any of the code paths in `SoupURI` leading to these two instances, so this is not a security issue. However, the functions should probably be fixed to do an appropriate length check, just in case they get called from somewhere else in future. Spotted by oss-fuzz in oss-fuzz#23815 and oss-fuzz#23818, when it was fuzzing the new `GUri` implementation in GLib, which is heavily based off this code. Includes two unit tests which don’t actually trigger the original failure (as all strings passed into `SoupURI` are forced to be nul-terminated), but would trigger it if the nul termination was not present. Signed-off-by: Philip Withnall <withnall@endlessm.com>
* Fix the new directory listing format stringMichael Catanzaro2020-06-271-1/+1
| | | | It broke 32-bit architectures.
* soup-directory-input-stream: Redesign directory listing layoutJan-Michael Brummer2020-06-265-10/+222
| | | | | | | | | - Fixes encoding issues on file names - Adds sorting support - Adds translations - Add CSS for nicer design Closes !123
* Eliminate leak of GTlsInteraction if re-specifiedScott Hutton2020-06-161-0/+1
|
* soup-brotli-decompressor.h: Fix build on Visual StudioChun-wei Fan2020-04-231-0/+1
| | | | | | | | | A SOUP_AVAILABLE_IN_2_68 (which expands to __dllspec(dllexport) extern was missed in the use of G_DECLARE_FINAL_TYPE (SoupBrotliDecompressor...), which broke Visual Studio builds because the first prototype of soup_brotli_decompressor_get_type() (that results from the G_DECLARE_FINAL_TYPE macro) was not marked with __declspec(dllexport) but the second one at line 35 is, which Visual Studio does not allow.
* Deprecate SoupSession:proxy-uriPatrick Griffis2020-02-171-1/+4
|
* Fix deprecation warningPatrick Griffis2020-02-131-1/+1
|
* Fix TRACE method not being considered safe and idempotentPatrick Griffis2020-01-281-1/+3
| | | | As defined by RFC 7231
* Simplify soup_cookie_jar_get_cookie_list_with_same_site_info() APIPatrick Griffis2020-01-282-16/+15
| | | | | | This changes passing an HTTP method string to just passing a boolean for if it is a safe method or not. This slightly simplifies usage within WebKit.
* WebSockets: ensure a new connection is created for WebSocket requestsCarlos Garcia Campos2020-01-281-0/+10
| | | | | The spec says a new connection must be established and some servers reply with a 400 Bad Request when reusing an existing connection.
* WebSockets: do not start the input source when IO is closingCarlos Garcia Campos2020-01-221-1/+2
| | | | | | | | | We should not schedule a new read after reading the close message, since we don't expect more input. This fixes a crash due to an assert that checks that the input source is NULL when the connection is destroyed that happens when the connection is destroyed in the closed callback. Fixes #181
* Expose support for same-site cookiesPatrick Griffis2020-01-219-18/+407
| | | | | | | | | | This adds API for web browsers to set extra information to support same-site cookies. Note that usage of SoupSession alone does not provide enough information to reasonably use these at the moment and require manually setting the information with the extra context a browser may have.
* soup-version: Add defs for 2.70 APIPatrick Griffis2020-01-211-0/+7
|
* SoupDate: deprecate soup_date_to_timeval()Claudio Saavedra2020-01-173-0/+14
| | | | | GTimeVal has been deprecated and shouldn't be used, so deprecate soup_date_to_timeval().
* SoupDate: bump soup_date_is_past() optimizationClaudio Saavedra2020-01-161-1/+1
|
* Always use G_PARAM_STATIC_STRINGSNiels De Graef2020-01-1324-116/+224
| | | | This prevents some unnecessary string copies and a tiny bit of memory.
* NTLM: Avoid a potential heap buffer overflow in v2 authenticationClaudio Saavedra2019-10-091-0/+6
| | | | | | | Check the length of the decoded v2 challenge before attempting to parse it, to avoid reading past it. Fixes #173
* WebSockets: client_max_window_bits in server response must have a valueCarlos Garcia Campos2019-10-071-10/+3
| | | | | | | The value is optional in the request offer, but not in the server response. Fixes: https://gitlab.gnome.org/GNOME/libsoup/issues/166
* SoupServer: fix to not allow smuggling ".." into pathIgnacio Casal Quinteiro2019-09-111-1/+9
| | | | | This was already fixed for Unix like systems but it was still possible to smuggle .. into a windows like server.
* soup-headers: fix a leak in the strict parsing codeClaudio Saavedra2019-09-111-1/+1
| | | | | Once we bail out we are not going to add the rest of the items to the hash table, so we need to manually delete them, otherwise they leak.
* WebSockets: plug another leak in the send_message() methodClaudio Saavedra2019-09-021-0/+2
| | | | | The GByteArray allocated in the beginning is not freed in case of error.
* WebSockets: fix read after free in send_message()Claudio Saavedra2019-09-021-7/+6
| | | | | g_byte_array_append() can reallocate its data, so make sure that we don't rely on any pointer pointing to it after calling it.
* WebSockets: plug a couple of leaks in case of error with the deflate extensionClaudio Saavedra2019-08-302-6/+5
| | | | | | Also remove a spurious unref in the caller while handling the error, which shouldn't be needed as the extension returns NULL in case of error.
* WebSockets: document how extensions should treat buffers in case of errorClaudio Saavedra2019-08-301-2/+2
| | | | | | | In case of error while processing an incoming or outgoing message, an extension should return NULL as is customary. This way, in case of error, the caller doesn't need to worry about having to deal with dropping the reference for the returned value if non-NULL.
* WebSockets: plug leak when payload exceds size limitClaudio Saavedra2019-08-301-0/+1
|
View Lorry Controller Status