DFBUGS-1214: [release-4.16] Non-linear parsing of case-insensitive content (CVE-2024-45338)

Update golang.org/x/net to 0.34.0

Signed-off-by: Niraj Yadav <niryadav@redhat.com>
This commit is contained in:
Niraj Yadav
2025-02-20 15:56:20 +05:30
parent cc432761ff
commit 19953b2fc4
26 changed files with 1122 additions and 859 deletions

View File

@ -16,7 +16,6 @@ import (
"encoding/binary"
"fmt"
"io"
"io/ioutil"
"net/http"
"net/url"
"strings"
@ -279,7 +278,7 @@ func (handler *hybiFrameHandler) HandleFrame(frame frameReader) (frameReader, er
}
}
if header := frame.HeaderReader(); header != nil {
io.Copy(ioutil.Discard, header)
io.Copy(io.Discard, header)
}
switch frame.PayloadType() {
case ContinuationFrame:
@ -294,7 +293,7 @@ func (handler *hybiFrameHandler) HandleFrame(frame frameReader) (frameReader, er
if err != nil && err != io.EOF && err != io.ErrUnexpectedEOF {
return nil, err
}
io.Copy(ioutil.Discard, frame)
io.Copy(io.Discard, frame)
if frame.PayloadType() == PingFrame {
if _, err := handler.WritePong(b[:n]); err != nil {
return nil, err

View File

@ -8,7 +8,7 @@
// This package currently lacks some features found in an alternative
// and more actively maintained WebSocket package:
//
// https://pkg.go.dev/nhooyr.io/websocket
// https://pkg.go.dev/github.com/coder/websocket
package websocket // import "golang.org/x/net/websocket"
import (
@ -17,7 +17,6 @@ import (
"encoding/json"
"errors"
"io"
"io/ioutil"
"net"
"net/http"
"net/url"
@ -208,7 +207,7 @@ again:
n, err = ws.frameReader.Read(msg)
if err == io.EOF {
if trailer := ws.frameReader.TrailerReader(); trailer != nil {
io.Copy(ioutil.Discard, trailer)
io.Copy(io.Discard, trailer)
}
ws.frameReader = nil
goto again
@ -330,7 +329,7 @@ func (cd Codec) Receive(ws *Conn, v interface{}) (err error) {
ws.rio.Lock()
defer ws.rio.Unlock()
if ws.frameReader != nil {
_, err = io.Copy(ioutil.Discard, ws.frameReader)
_, err = io.Copy(io.Discard, ws.frameReader)
if err != nil {
return err
}
@ -362,7 +361,7 @@ again:
return ErrFrameTooLarge
}
payloadType := frame.PayloadType()
data, err := ioutil.ReadAll(frame)
data, err := io.ReadAll(frame)
if err != nil {
return err
}