chore(deps): update dependency aiohttp to v3.8.5 [security]

This PR contains the following updates:

Package	Update	Change
aiohttp	patch	`==3.8.4` -> `==3.8.5`

GitHub Vulnerability Alerts

CVE-2023-37276

Impact

aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6 which is vulnerable to CVE-2023-30589. The vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel.

This vulnerability only affects users of aiohttp as an HTTP server (ie aiohttp.Application), you are not affected by this vulnerability if you are using aiohttp as an HTTP client library (ie aiohttp.ClientSession).

Reproducer

from aiohttp import web

async def example(request: web.Request):
    headers = dict(request.headers)
    body = await request.content.read()
    return web.Response(text=f"headers: {headers} body: {body}")

app = web.Application()
app.add_routes([web.post('/', example)])
web.run_app(app)

Sending a crafted HTTP request will cause the server to misinterpret one of the HTTP header values leading to HTTP request smuggling.

$ printf "POST / HTTP/1.1\r\nHost: localhost:8080\r\nX-Abc: \rxTransfer-Encoding: chunked\r\n\r\n1\r\nA\r\n0\r\n\r\n" \
  | nc localhost 8080

Expected output:
  headers: {'Host': 'localhost:8080', 'X-Abc': '\rxTransfer-Encoding: chunked'} body: b''

Actual output (note that 'Transfer-Encoding: chunked' is an HTTP header now and body is treated differently)
  headers: {'Host': 'localhost:8080', 'X-Abc': '', 'Transfer-Encoding': 'chunked'} body: b'A'

Patches

Upgrade to the latest version of aiohttp to resolve this vulnerability. It has been fixed in v3.8.5: pip install aiohttp >= 3.8.5

Workarounds

If you aren't able to upgrade you can reinstall aiohttp using AIOHTTP_NO_EXTENSIONS=1 as an environment variable to disable the llhttp HTTP request parser implementation. The pure Python implementation isn't vulnerable to request smuggling:

$ python -m pip uninstall --yes aiohttp
$ AIOHTTP_NO_EXTENSIONS=1 python -m pip install --no-binary=aiohttp --no-cache aiohttp

References

Release Notes

aio-libs/aiohttp (aiohttp)

### [`v3.8.5`](https://togithub.com/aio-libs/aiohttp/releases/tag/v3.8.5): 3.8.5 [Compare Source](https://togithub.com/aio-libs/aiohttp/compare/v3.8.4...v3.8.5) ## Security bugfixes - Upgraded the vendored copy of llhttp\_ to v8.1.1 -- by :user:`webknjaz` and :user:`Dreamsorcerer`. Thanks to :user:`sethmlarson` for reporting this and providing us with comprehensive reproducer, workarounds and fixing details! For more information, see https://github.com/aio-libs/aiohttp/security/advisories/GHSA-45c4-8wx5-qw6w. .. \_llhttp: https://llhttp.org ([#7346](https://togithub.com/aio-libs/aiohttp/issues/7346)) ## Features - Added information to C parser exceptions to show which character caused the error. -- by :user:`Dreamsorcerer` ([#7366](https://togithub.com/aio-libs/aiohttp/issues/7366)) ## Bugfixes - Fixed a transport is :data:`None` error -- by :user:`Dreamsorcerer`. ([#3355](https://togithub.com/aio-libs/aiohttp/issues/3355)) ***

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

Easy and customizable dashboards for your build system. Learn more about Stoat ↗︎

Static Hosting

Name	Link	Commit	Status
api-coverage	Visit	9c0184c0749b901760fd3b7eb5719b6ef7e3ad1f	✅
rtc-coverage	Visit	9c0184c0749b901760fd3b7eb5719b6ef7e3ad1f	✅
core-coverage	Visit	9c0184c0749b901760fd3b7eb5719b6ef7e3ad1f	✅
cron-coverage	Visit	9c0184c0749b901760fd3b7eb5719b6ef7e3ad1f	✅
email-coverage	Visit	9c0184c0749b901760fd3b7eb5719b6ef7e3ad1f	✅
worker-coverage	Visit	9c0184c0749b901760fd3b7eb5719b6ef7e3ad1f	✅
api-test-results	Visit	9c0184c0749b901760fd3b7eb5719b6ef7e3ad1f	✅
graphql-coverage	Visit	9c0184c0749b901760fd3b7eb5719b6ef7e3ad1f	✅
rtc-test-results	Visit	9c0184c0749b901760fd3b7eb5719b6ef7e3ad1f	✅
core-test-results	Visit	9c0184c0749b901760fd3b7eb5719b6ef7e3ad1f	✅
cron-test-results	Visit	9c0184c0749b901760fd3b7eb5719b6ef7e3ad1f	✅
email-test-results	Visit	9c0184c0749b901760fd3b7eb5719b6ef7e3ad1f	✅
worker-test-results	Visit	9c0184c0749b901760fd3b7eb5719b6ef7e3ad1f	✅
graphql-test-results	Visit	9c0184c0749b901760fd3b7eb5719b6ef7e3ad1f	✅

pluralsh / plural