Benoit Chesneau 2073e13dc8 fix: reject control characters in header field-value (RFC 9110 section 5.5) ...

field-vchar = VCHAR / obs-text; only SP and HTAB are permitted beyond
that. Previous validation only caught NUL/CR/LF, leaving BEL, DEL, FF,
and other C0/C1 controls accepted — a log/response injection risk. Now
rejected across the WSGI and ASGI Python parsers.

2026-04-19 12:07:16 +02:00

..

app

class Name(object): -> class Name:

2024-04-22 03:33:30 +02:00

asgi

fix: reject control characters in header field-value (RFC 9110 section 5.5)

2026-04-19 12:07:16 +02:00

ctl

Use user-writable default path for control socket (#3551)

2026-03-23 20:08:03 +01:00

dirty

fix: resolve pylint warnings

2026-02-13 02:40:01 +01:00

http

fix: reject control characters in header field-value (RFC 9110 section 5.5)

2026-04-19 12:07:16 +02:00

http2

Fix _handle_stream_ended to set _body_complete in async HTTP/2 handler

2026-04-01 11:53:06 +11:00

instrument

fix: remove trailing blank line in instrument/__init__.py

2026-02-06 08:36:35 +01:00

uwsgi

Fix uwsgi incomplete header error with async workers (#3554)

2026-03-24 23:17:51 +01:00

workers

fix: drain connection on close per RFC 9112 section 9.6

2026-04-19 09:41:07 +02:00

__init__.py

Update to gunicorn_h1c >= 0.6.2 for asgi_headers support

2026-03-26 15:45:11 +01:00

__main__.py

drop long-default - coding: utf-8

2024-04-22 03:33:14 +02:00

arbiter.py

fix(ctl): prevent fork deadlock in control socket server

2026-02-26 20:54:35 +01:00

config.py

Use user-writable default path for control socket (#3551)

2026-03-23 20:08:03 +01:00

debug.py

Python 3.3+: replace deprecated aliases

2024-04-22 03:33:31 +02:00

errors.py

drop long-default - coding: utf-8

2024-04-22 03:33:14 +02:00

glogging.py

Optimize ASGI protocol for 16x performance improvement

2026-03-21 22:20:05 +01:00

pidfile.py

fix: ensure pidfile fd is closed on rename failure

2026-02-20 06:17:29 +03:00

reloader.py

feat: InotifyReloader now watches newly loaded modules

2026-01-23 11:39:05 +01:00

sock.py

Add HTTP/2 dependency and configuration

2026-01-27 09:57:01 +01:00

systemd.py

fix: prevent UnboundLocalError in sd_notify when socket creation fails

2026-02-20 06:16:54 +03:00

util.py

fix: drain connection on close per RFC 9112 section 9.6

2026-04-19 09:41:07 +02:00