c7dc3a8d72
This version includes a fix that seems relevant to us: > The HTTP/1 client did not fully validate the contents of the Host header. A maliciously crafted Host header could inject additional headers or entire requests. The HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value. > > Thanks to Bartek Nowotarski for reporting this issue. > > Includes security fixes for CVE-2023-29406 and Go issue https://go.dev/issue/60374 |
||
|---|---|---|
| .. | ||
| proto | ||
| mock_test.go | ||
| ra.go | ||
| ra_test.go | ||