yhirose/cpp-httplib v0.63.0

on GitHub

What's Changed

Behavior changes

Several fixes below change behavior that existing code may rely on:

• Server: a mount point serves a path only when it has no ., .. or empty segment other than a trailing /. Any other path gets 404, where such segments used to be resolved through the file system.
• Server: SSLServer::update_certs_pem() given a client CA makes client certificates required, as the constructors do when they are given one.
• Server: SSLServer::PemMemory reads client_ca_pem as a NUL-terminated string when client_ca_pem_len is 0, like the other fields. An empty client CA makes the server invalid.
• Client: a CA given to set_ca_cert_store() or load_ca_cert_store() keeps the system CAs out even when it brings no certificate, such as a NULL store or an empty PEM, so the client fails verification instead of trusting the system CAs.
• Client: the OpenSSL backend verifies the server certificate and its host name during the handshake, unless a session verifier is set. A certificate that fails the built-in verification reports CertVerifyFailed, or HostnameMismatch for its name, in ssl_error() on every backend, where OpenSSL used to leave it 0.

Security-relevant fixes

• Request parsing and message framing:
  • Close the connection after answering a WebSocket upgrade request that carries a body (#2637). When the pre-routing or pre-request handler answered such a request with a 2xx or 3xx, the body was left unread and parsed as the next request on the keep-alive connection.
• Static files:
  • Serve only canonical paths from mount points. A mount point left ., .. and empty path segments for the file system to resolve, while the pre-routing handler, where the README has applications guard static files, saw the path as it was sent, so a file could be reached under a spelling that a check on req.path did not match. The README also notes the other names a file system can give a file, such as another letter case on a case-insensitive file system.
• TLS:
  • Require client certificates on a server given its client CA through SSLServer::PemMemory with a length of 0. The client CA was skipped, so the server started without requiring client certificates.
  • Require client certificates once update_certs_pem() loads a client CA. On a server built without one, the update returned true but left client certificate verification off.
  • Keep the system CAs out when a custom CA comes through empty. A NULL store, such as the one tls::create_ca_store() returns for a PEM it cannot parse, or an empty PEM left the client trusting every system CA.
  • Verify the server certificate during the handshake on OpenSSL. The client presented its client certificate before finding that the server failed verification, and wolfSSL did the same when a server certificate verifier accepted the certificate. A verifier now runs alongside the built-in verification during the handshake on every backend, as the README describes.
  • Drop the SNI of a failed handshake on the Mbed TLS server. It stayed with the worker thread, so the next connection without SNI on that thread reported the earlier client's name in req.sni().

Bug fixes

• Client: end the stream at the header section for HEAD, 204 and 304 in open_stream() (#2636). The body reader was built from Content-Length and Transfer-Encoding whatever the method or status, so read() blocked until the read timeout on a keep-alive connection, and stream::Head() against a server that sends the GET body's Content-Length on HEAD hit it every time. A Content-Encoding the build lacks no longer fails such a stream either.
• Mbed TLS 4.x: tls::create_ca_store() returned NULL for a valid PEM when no TLS context existed yet.

Documentation

• README: note that a length of 0 in PemMemory means a NUL-terminated string, describe which paths a mount point serves and the other names a file system can give a file, and describe the ssl_error() values for a failed certificate verification.

Full Changelog: v0.62.0...v0.63.0