security: dependency security vulnerability

[slievrly]

golang.org/x/net

• Affected versions：< 0.7.0
• Patched version：0.7.0
• Description : A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

github.com/gin-gonic/gin

• Affected versions：>= 1.3.1-0.20190301021747-ccb9e902956d, < 1.9.1
• Patched version：1.91.
• Description : The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat";x=.txt" will be sent as a file named "setup.bat".

If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.

[Issues-translate-bot]

RoBot detected the issue body's language is not English, translate it automatically. 👯👭🏻🧑‍🤝‍🧑👫🧑🏿‍🤝‍🧑🏻👩🏾‍🤝‍👨🏿👬🏿

---

Title: security: dependency security vulnerability

[xjlgod]

Is it enough to upgrade the corresponding dependencies to versions 0.7.0 and 1.9.1 or above and adapt the corresponding code?