yhirose/cpp-httplib v0.65.0

on GitHub

What's Changed

Behavior changes

• Client: with set_follow_location(true), the parameters in Request::params are no longer sent again to a redirect target. The next request goes to the Location as given, as it already did for Get(path, params, ...).
• Server: a Range header with a unit other than bytes is ignored and the whole response is sent (#2657), as RFC 9110 section 14.2 requires. It used to be answered with 416.

Security-relevant fixes

• Client:
  • Do not carry Request::params over to a redirect, as described above. They were appended to a Location with no query, so they could reach another origin.
  • Keep a relative Location on the current host when its resolved path starts with // (#2654). The path was read as an authority, and the redirect went to another host.

Bug fixes

• Client: stop() interrupts a request waiting for a response on Windows too (#2653). The request used to wait until the server answered or the read timeout passed.
• Windows: cap a single send() at INT_MAX on 64-bit builds too (#2655). A write of 4 GiB or more could hang.
• wolfSSL: cap a read at INT_MAX (#2655). A read into a buffer larger than that failed.

Full Changelog: v0.64.0...v0.65.0