openfaas / of-watchdog

Reverse proxy for STDIO and HTTP microservices
MIT License
259 stars 115 forks source link

Bump go version to 1.11.13 #79

Closed LucasRoesler closed 4 years ago

LucasRoesler commented 4 years ago

net/http: Denial of Service vulnerabilities in the HTTP/2 implementation

net/http and golang.org/x/net/http2 servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. Servers will now close connections if the send queue accumulates too many control messages.

net/url: parsing validation issue

url.Parse would accept URLs with malformed hosts, such that the Host field could have arbitrary suffixes that would appear in neither Hostname() nor Port(), allowing authorization bypasses in certain applications. Note that URLs with invalid, not numeric ports will now return an error from url.Parse.

Motivation and Context

Resolves #78

How Has This Been Tested?

Built the image and then exec-ing the binary using

docker build -t openfaas/of-watchdog:build .
docker run --rm -it openfaas/of-watchdog:build ./of-watchdog -h

Types of changes

Checklist: