From b79f92a2b47d2bb3e130b28610040f39579a53aa Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 3 Jun 2026 21:14:00 +0000 Subject: [PATCH] Bump github.com/quic-go/quic-go from 0.59.0 to 0.59.1 in /v2 Bumps [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) from 0.59.0 to 0.59.1. - [Release notes](https://github.com/quic-go/quic-go/releases) - [Commits](https://github.com/quic-go/quic-go/compare/v0.59.0...v0.59.1) --- updated-dependencies: - dependency-name: github.com/quic-go/quic-go dependency-version: 0.59.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] --- v2/go.mod | 3 +- v2/go.sum | 6 +- .../quic-go/quic-go/http3/headers.go | 74 ++++++-- .../github.com/xyproto/pinterface/.gitignore | 24 --- .../github.com/xyproto/pinterface/.travis.yml | 11 -- .../github.com/xyproto/pinterface/LICENSE | 11 -- .../github.com/xyproto/pinterface/README.md | 28 --- .../xyproto/pinterface/pinterface.go | 162 ------------------ v2/vendor/modules.txt | 5 +- 9 files changed, 60 insertions(+), 264 deletions(-) delete mode 100644 v2/vendor/github.com/xyproto/pinterface/.gitignore delete mode 100644 v2/vendor/github.com/xyproto/pinterface/.travis.yml delete mode 100644 v2/vendor/github.com/xyproto/pinterface/LICENSE delete mode 100644 v2/vendor/github.com/xyproto/pinterface/README.md delete mode 100644 v2/vendor/github.com/xyproto/pinterface/pinterface.go diff --git a/v2/go.mod b/v2/go.mod index dba97463..8e2aaf22 100644 --- a/v2/go.mod +++ b/v2/go.mod @@ -9,7 +9,6 @@ require ( github.com/gomodule/redigo v1.9.3 github.com/urfave/negroni v1.0.0 github.com/xyproto/cookie/v2 v2.2.7 - github.com/xyproto/pinterface v1.6.0 github.com/xyproto/pinterface/v2 v2.1.2 github.com/xyproto/simpleredis/v2 v2.9.0 github.com/zenazn/goji v1.0.1 @@ -37,7 +36,7 @@ require ( github.com/modern-go/reflect2 v1.0.2 // indirect github.com/pelletier/go-toml/v2 v2.3.1 // indirect github.com/quic-go/qpack v0.6.0 // indirect - github.com/quic-go/quic-go v0.59.0 // indirect + github.com/quic-go/quic-go v0.59.1 // indirect github.com/twitchyliquid64/golang-asm v0.15.1 // indirect github.com/ugorji/go/codec v1.3.1 // indirect github.com/xyproto/randomstring v1.2.0 // indirect diff --git a/v2/go.sum b/v2/go.sum index 9756c041..a5dc9506 100644 --- a/v2/go.sum +++ b/v2/go.sum @@ -57,8 +57,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8= github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII= -github.com/quic-go/quic-go v0.59.0 h1:OLJkp1Mlm/aS7dpKgTc6cnpynnD2Xg7C1pwL6vy/SAw= -github.com/quic-go/quic-go v0.59.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU= +github.com/quic-go/quic-go v0.59.1 h1:0Gmua0HW1Tv7ANR7hUYwRyD0MG5OJfgvYSZasGZzBic= +github.com/quic-go/quic-go v0.59.1/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= @@ -78,8 +78,6 @@ github.com/urfave/negroni v1.0.0 h1:kIimOitoypq34K7TG7DUaJ9kq/N4Ofuwi1sjz0KipXc= github.com/urfave/negroni v1.0.0/go.mod h1:Meg73S6kFm/4PpbYdq35yYWoCZ9mS/YSx+lKnmiohz4= github.com/xyproto/cookie/v2 v2.2.7 h1:0Cj72/1ftzP0E/ca52YrF6RNyhMyCvl7fjPcvwsr9fE= github.com/xyproto/cookie/v2 v2.2.7/go.mod h1:wW8OiGxgIP7knzx9qZYA1NkicfCYDo/T0QyxUZ5Sd3o= -github.com/xyproto/pinterface v1.6.0 h1:9AACoo9KvEHMZ51Aem8nnvMabTkNnE3Ye26Fke5qW3M= -github.com/xyproto/pinterface v1.6.0/go.mod h1:X5B5pKE49ak7SpyDh5QvJvLH9cC9XuZNDcl5hEyYc34= github.com/xyproto/pinterface/v2 v2.1.2 h1:PhCqZpwknL0w0o1FNv9XsCk54ArgK7fogwvvBzLKw9c= github.com/xyproto/pinterface/v2 v2.1.2/go.mod h1:JEnbIgxF7qfkASFr8EXLhd2ymhd6xLG0Eq5xkFHqyXw= github.com/xyproto/randomstring v1.2.0 h1:y7PXAEBM3XlwJjPG2JQg4voxBYZ4+hPgRdGKCfU8wik= diff --git a/v2/vendor/github.com/quic-go/quic-go/http3/headers.go b/v2/vendor/github.com/quic-go/quic-go/http3/headers.go index 111c5aea..11f44d58 100644 --- a/v2/vendor/github.com/quic-go/quic-go/http3/headers.go +++ b/v2/vendor/github.com/quic-go/quic-go/http3/headers.go @@ -8,6 +8,7 @@ import ( "net/http" "net/textproto" "net/url" + "slices" "strconv" "strings" @@ -72,12 +73,8 @@ func parseHeaders(decodeFn qpack.DecodeFunc, isRequest bool, sizeLimit int, head if sizeLimit < 0 { return header{}, errHeaderTooLarge } - // field names need to be lowercase, see section 4.2 of RFC 9114 - if strings.ToLower(h.Name) != h.Name { - return header{}, fmt.Errorf("header field is not lower-case: %s", h.Name) - } - if !httpguts.ValidHeaderFieldValue(h.Value) { - return header{}, fmt.Errorf("invalid header field value for %s: %q", h.Name, h.Value) + if err := validateHeaderFieldNameAndValue(h); err != nil { + return header{}, err } if h.IsPseudo() { if readFirstRegularHeader { @@ -119,16 +116,8 @@ func parseHeaders(decodeFn qpack.DecodeFunc, isRequest bool, sizeLimit int, head return header{}, fmt.Errorf("invalid response pseudo header: %s", h.Name) } } else { - if !httpguts.ValidHeaderFieldName(h.Name) { - return header{}, fmt.Errorf("invalid header field name: %q", h.Name) - } - for _, invalidField := range invalidHeaderFields { - if h.Name == invalidField { - return header{}, fmt.Errorf("invalid header field name: %q", h.Name) - } - } - if h.Name == "te" && h.Value != "trailers" { - return header{}, fmt.Errorf("invalid TE header field value: %q", h.Value) + if err := validateRegularHeaderField(h); err != nil { + return header{}, err } readFirstRegularHeader = true switch h.Name { @@ -159,7 +148,41 @@ func parseHeaders(decodeFn qpack.DecodeFunc, isRequest bool, sizeLimit int, head return hdr, nil } -func parseTrailers(decodeFn qpack.DecodeFunc, headerFields *[]qpack.HeaderField) (http.Header, error) { +func validateHeaderFieldNameAndValue(h qpack.HeaderField) error { + // field names need to be lowercase, see section 4.2 of RFC 9114 + if strings.ToLower(h.Name) != h.Name { + return fmt.Errorf("header field is not lower-case: %s", h.Name) + } + if !httpguts.ValidHeaderFieldValue(h.Value) { + return fmt.Errorf("invalid header field value for %s: %q", h.Name, h.Value) + } + return nil +} + +func validateRegularHeaderField(h qpack.HeaderField) error { + if !httpguts.ValidHeaderFieldName(h.Name) { + return fmt.Errorf("invalid header field name: %q", h.Name) + } + if slices.Contains(invalidHeaderFields[:], h.Name) { + return fmt.Errorf("invalid header field name: %q", h.Name) + } + if h.Name == "te" && h.Value != "trailers" { + return fmt.Errorf("invalid TE header field value: %q", h.Value) + } + return nil +} + +func validateTrailerHeaderField(h qpack.HeaderField) error { + if err := validateRegularHeaderField(h); err != nil { + return err + } + if !httpguts.ValidTrailerHeader(h.Name) { + return fmt.Errorf("invalid trailer field name: %q", h.Name) + } + return nil +} + +func parseTrailers(decodeFn qpack.DecodeFunc, sizeLimit int, headerFields *[]qpack.HeaderField) (http.Header, error) { h := make(http.Header) for { hf, err := decodeFn() @@ -172,9 +195,22 @@ func parseTrailers(decodeFn qpack.DecodeFunc, headerFields *[]qpack.HeaderField) if headerFields != nil { *headerFields = append(*headerFields, hf) } + // RFC 9114, section 4.2.2: + // The size of a field list is calculated based on the uncompressed size of fields, + // including the length of the name and value in bytes plus an overhead of 32 bytes for each field. + sizeLimit -= len(hf.Name) + len(hf.Value) + 32 + if sizeLimit < 0 { + return nil, errHeaderTooLarge + } + if err := validateHeaderFieldNameAndValue(hf); err != nil { + return nil, err + } if hf.IsPseudo() { return nil, fmt.Errorf("http3: received pseudo header in trailer: %s", hf.Name) } + if err := validateTrailerHeaderField(hf); err != nil { + return nil, err + } h.Add(hf.Name, hf.Value) } return h, nil @@ -365,10 +401,12 @@ func decodeTrailers(r io.Reader, hf *headersFrame, maxHeaderBytes int, decoder * } decodeFn := decoder.Decode(b) var fields []qpack.HeaderField + var headerFields *[]qpack.HeaderField if qlogger != nil { fields = make([]qpack.HeaderField, 0, 16) + headerFields = &fields } - trailers, err := parseTrailers(decodeFn, &fields) + trailers, err := parseTrailers(decodeFn, maxHeaderBytes, headerFields) if err != nil { maybeQlogInvalidHeadersFrame(qlogger, streamID, hf.Length) return nil, err diff --git a/v2/vendor/github.com/xyproto/pinterface/.gitignore b/v2/vendor/github.com/xyproto/pinterface/.gitignore deleted file mode 100644 index daf913b1..00000000 --- a/v2/vendor/github.com/xyproto/pinterface/.gitignore +++ /dev/null @@ -1,24 +0,0 @@ -# Compiled Object files, Static and Dynamic libs (Shared Objects) -*.o -*.a -*.so - -# Folders -_obj -_test - -# Architecture specific extensions/prefixes -*.[568vq] -[568vq].out - -*.cgo1.go -*.cgo2.c -_cgo_defun.c -_cgo_gotypes.go -_cgo_export.* - -_testmain.go - -*.exe -*.test -*.prof diff --git a/v2/vendor/github.com/xyproto/pinterface/.travis.yml b/v2/vendor/github.com/xyproto/pinterface/.travis.yml deleted file mode 100644 index 609d361a..00000000 --- a/v2/vendor/github.com/xyproto/pinterface/.travis.yml +++ /dev/null @@ -1,11 +0,0 @@ -language: go - -go: - - "1.8" - - "1.9" - - "1.10" - - "1.11" - - "1.12" - - "1.13" - - "1.14" - - tip diff --git a/v2/vendor/github.com/xyproto/pinterface/LICENSE b/v2/vendor/github.com/xyproto/pinterface/LICENSE deleted file mode 100644 index 8f1cfcaa..00000000 --- a/v2/vendor/github.com/xyproto/pinterface/LICENSE +++ /dev/null @@ -1,11 +0,0 @@ -Copyright 2026 Alexander F. Rødseth - -Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - -1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - -2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - -3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/v2/vendor/github.com/xyproto/pinterface/README.md b/v2/vendor/github.com/xyproto/pinterface/README.md deleted file mode 100644 index 9dbf2efd..00000000 --- a/v2/vendor/github.com/xyproto/pinterface/README.md +++ /dev/null @@ -1,28 +0,0 @@ -# pinterface - -[![Go Report Card](https://goreportcard.com/badge/github.com/xyproto/pinterface)](https://goreportcard.com/report/github.com/xyproto/pinterface) [![License](https://img.shields.io/badge/license-BSD-green.svg?style=flat)](https://raw.githubusercontent.com/xyproto/pinterface/main/LICENSE) - -Interface types for `simple*` and `permission*` packages. - -Interfaces for: ---------------- - -* Redis: [permissions2](https://github.com/xyproto/permissions2) and [simpleredis](https://github.com/xyproto/simpleredis) -* Bolt: [permissionbolt](https://github.com/xyproto/permissionbolt) and [simplebolt](https://github.com/xyproto/simplebolt) -* MariaDB/MySQL: [permissionsql](https://github.com/xyproto/permissionsql) and [simplemaria](https://github.com/xyproto/simplemaria) -* PostgreSQL: [pstore](https://github.com/xyproto/pstore) and [simplehstore](https://github.com/xyproto/simplehstore) -* SQLite: [simplesqlite](https://github.com/terminar/simplesqlite) and [permissionsqlite](https://github.com/terminar/permissionsqlite) - -[![Packaging status](https://repology.org/badge/vertical-allrepos/go:github-xyproto-pinterface.svg)](https://repology.org/project/go:github-xyproto-pinterface/versions) - -Packaging ---------- - -* The latest release is the `v1.6.0` tag. The `v1*` versioning scheme was put to use since this is what `go mod` seems to prefer. - -General information -------------------- - -* Version: 1.6.0 (The tag is `v1.6.0` to work better with `go mod`. The API has version `6.0`.) -* License: BSD-3 -* Author: Alexander F. Rødseth <xyproto@archlinux.org> diff --git a/v2/vendor/github.com/xyproto/pinterface/pinterface.go b/v2/vendor/github.com/xyproto/pinterface/pinterface.go deleted file mode 100644 index f9f4d797..00000000 --- a/v2/vendor/github.com/xyproto/pinterface/pinterface.go +++ /dev/null @@ -1,162 +0,0 @@ -// Package pinterface provides interface types for the xyproto/simple* and xyproto/permission* packages + terminar/permissionsqlite -package pinterface - -import "net/http" - -// Version is the API version. The API is stable within the same major version number -const Version = 6.0 - -// Database interfaces - -type IList interface { - Add(value string) error - All() ([]string, error) - Clear() error - LastN(n int) ([]string, error) - Last() (string, error) - Remove() error - LastUpToN(n uint64) ([]string, error) -} - -type ISet interface { - Add(value string) error - All() ([]string, error) - Clear() error - Del(value string) error - Has(value string) (bool, error) - Remove() error -} - -type IHashMap interface { - All() ([]string, error) - Clear() error - DelKey(owner, key string) error - Del(key string) error - Exists(owner string) (bool, error) - Get(owner, key string) (string, error) - Has(owner, key string) (bool, error) - Keys(owner string) ([]string, error) - Remove() error - Set(owner, key, value string) error -} - -type IHashMap2 interface { - All() ([]string, error) - AllWhere(key, value string) ([]string, error) - Clear() error - Count() (int64, error) - DelKey(owner, key string) error - Del(key string) error - Empty() (bool, error) - Exists(owner string) (bool, error) - GetMap(owner string, keys []string) (map[string]string, error) - Get(owner, key string) (string, error) - Has(owner, key string) (bool, error) - Keys(owner string) ([]string, error) - Remove() error - SetLargeMap(all map[string]map[string]string) error - SetMap(owner string, m map[string]string) error - Set(owner, key, value string) error -} - -type IKeyValue interface { - Clear() error - Del(key string) error - Get(key string) (string, error) - Inc(key string) (string, error) - Remove() error - Set(key, value string) error -} - -// Interface for making it possible to depend on different versions of the permission package, -// or other packages that implement userstates. -type IUserState interface { - AddUnconfirmed(username, confirmationCode string) - AddUser(username, password, email string) - AdminRights(req *http.Request) bool - AllUnconfirmedUsernames() ([]string, error) - AllUsernames() ([]string, error) - AlreadyHasConfirmationCode(confirmationCode string) bool - BooleanField(username, fieldname string) bool - ClearCookie(w http.ResponseWriter) - ConfirmationCode(username string) (string, error) - ConfirmUserByConfirmationCode(confirmationcode string) error - Confirm(username string) - CookieSecret() string - CookieTimeout(username string) int64 - CorrectPassword(username, password string) bool - Email(username string) (string, error) - FindUserByConfirmationCode(confirmationcode string) (string, error) - GenerateUniqueConfirmationCode() (string, error) - HashPassword(username, password string) string - HasUser(username string) bool - IsAdmin(username string) bool - IsConfirmed(username string) bool - IsLoggedIn(username string) bool - Login(w http.ResponseWriter, username string) error - Logout(username string) - MarkConfirmed(username string) - PasswordAlgo() string - PasswordHash(username string) (string, error) - RemoveAdminStatus(username string) - RemoveUnconfirmed(username string) - RemoveUser(username string) - SetAdminStatus(username string) - SetBooleanField(username, fieldname string, val bool) - SetCookieSecret(cookieSecret string) - SetCookieTimeout(cookieTime int64) - SetLoggedIn(username string) - SetLoggedOut(username string) - SetMinimumConfirmationCodeLength(length int) - SetPasswordAlgo(algorithm string) error - SetPassword(username, password string) - SetUsernameCookie(w http.ResponseWriter, username string) error - UsernameCookie(req *http.Request) (string, error) - Username(req *http.Request) string - UserRights(req *http.Request) bool - - Creator() ICreator - Host() IHost - Users() IHashMap -} - -// Data structure creator -type ICreator interface { - NewHashMap(id string) (IHashMap, error) - NewKeyValue(id string) (IKeyValue, error) - NewList(id string) (IList, error) - NewSet(id string) (ISet, error) -} - -// Database host (or file) -type IHost interface { - Close() - Ping() error -} - -// Redis host (implemented structures can also be an IHost, of course) -type IRedisHost interface { - DatabaseIndex() - Pool() -} - -// Redis data structure creator -type IRedisCreator interface { - SelectDatabase(dbindex int) -} - -// Middleware for permissions -type IPermissions interface { - AddAdminPath(prefix string) - AddPublicPath(prefix string) - AddUserPath(prefix string) - Clear() - DenyFunction() http.HandlerFunc - Rejected(w http.ResponseWriter, req *http.Request) bool - ServeHTTP(w http.ResponseWriter, req *http.Request, next http.HandlerFunc) - SetAdminPath(pathPrefixes []string) - SetDenyFunction(f http.HandlerFunc) - SetPublicPath(pathPrefixes []string) - SetUserPath(pathPrefixes []string) - UserState() IUserState -} diff --git a/v2/vendor/modules.txt b/v2/vendor/modules.txt index 6eb4a778..ec8c6c42 100644 --- a/v2/vendor/modules.txt +++ b/v2/vendor/modules.txt @@ -142,7 +142,7 @@ github.com/pelletier/go-toml/v2/unstable # github.com/quic-go/qpack v0.6.0 ## explicit; go 1.24 github.com/quic-go/qpack -# github.com/quic-go/quic-go v0.59.0 +# github.com/quic-go/quic-go v0.59.1 ## explicit; go 1.24 github.com/quic-go/quic-go github.com/quic-go/quic-go/http3 @@ -190,9 +190,6 @@ github.com/urfave/negroni # github.com/xyproto/cookie/v2 v2.2.7 ## explicit; go 1.17 github.com/xyproto/cookie/v2 -# github.com/xyproto/pinterface v1.6.0 -## explicit; go 1.8 -github.com/xyproto/pinterface # github.com/xyproto/pinterface/v2 v2.1.2 ## explicit; go 1.8 github.com/xyproto/pinterface/v2