allow multiple set-cookie headers#435
Conversation
|
Thanks for the fix, when will this be merged and released? |
|
once someone tests this PR properly and provides feedback |
|
As we encountered this bug as well (see go-gitea/gitea#31202 for reference), we'd kindly like to ask if there is any progress yet. We were able to confirm that the bug was fixed at least in our case by building a custom tinyproxy (based on the Debian sources https://salsa.debian.org/debian/tinyproxy/-/tags/debian%2F1.11.1-2) after applying these three (1cd92e5, 2508c1a, 78e4a6d) commits on top. |
|
This fixes it for me too |
|
I try to use 1.11.1-2 version ,but do not work . and i also use the lasted 1.11.2version ，do not work to ,only return one cookie . the website can return two cookie |
JGabrielGruber
left a comment
There was a problem hiding this comment.
Not a C expert, but seems good to me!
|
@LauKr are you running this patch in production since you posted here ? |
|
No, we tested and found no issues, however, as we didn't want to check for patches etc manually, we decided to use another proxy for now, even though it's not as minimal any longer. |
|
I've been running my deployments with this patch, and it's working great! |
it turned out that a hashmap isn't the right datastructure, as the special-case header Set-Cookie not only can, but is even heavily recommended to be used multiple times. we now use a dumb list as a key-value store for this purpose, but restrict it to max 256 entries so the linear search can always be completed in reasonable time in case of an attack. closes tinyproxy#403
78e4a6d to
4aece05
Compare
|
ok, thanks to everyone for testing. let's hope sufficient amounts of people compile tinyproxy from git so if there's any more bugs in it it will be discovered in due time. |
it turned out that a hashmap isn't the right datastructure, as the
special-case header Set-Cookie not only can, but is even heavily
recommended to be used multiple times.
we now use a dumb list as a key-value store for this purpose, but
restrict it to max 256 entries so the linear search can always be
completed in reasonable time in case of an attack.
closes #403