Repository navigation
fix(turnloop-http): decoder-only brotli 6.2, rejecting large-window streams - #132
Merged
Merged
Conversation
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 6 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
proggeramlug
force-pushed
the
fix/brotli-decoder-only
branch
from
November 8, 2026 07:04
8fc376f to
c96a919
Compare
…oder turnloop-http only decodes, and every symbol it uses is exported by brotli-decompressor, which the brotli umbrella crate wraps. Depending on it directly drops the Brotli encoder (most of brotli's source) from every consumer's graph. The encoder stays a dev-dependency for the test fixtures. Closes #112
proggeramlug
force-pushed
the
fix/brotli-decoder-only
branch
from
November 8, 2026 07:14
c96a919 to
dc8ea76
Compare
BrotliState::new accepts the non-standard large-window format, whose window reaches 1 GiB: an 850-byte body could make the decoder allocate that before the decoded-size limit applies (the shape of actix-http's RUSTSEC-2026-0455). Content-Encoding: br is RFC 7932 Brotli, which new_strict decodes; Node's decoder also rejects large windows by default. brotli-decompressor 6.2.0 also carries the 6.x hardening missing from 5.0.3: no panics on malformed streams, the streaming bounds overflow and uncompressed-metablock length fixes, and the CVE-2026-111497 input error. 6.3.0 (performance only) is younger than the seven-day soak. The brotli encoder, a dev-dependency, moves to 9.1.1.
proggeramlug
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
turnloop-httponly decodes Brotli, so it now depends onbrotli-decompressordirectly instead of thebrotliumbrella crate. That takes the encoder out of every consumer's dependency graph.brotliremains a dev-dependency, because the tests use it to compress their fixtures.Security hardening
Large-window Brotli is rejected.
BrotliState::newalso accepts the non-standard large-window format, whose window can reach 1 GiB. A tiny body could make the decoder allocate that before the decoded-size limit applies. This is the same denial of service as actix-http's RUSTSEC-2026-0455 (GHSA-7p9w-p5qm-5gc5).Content-Encoding: brmeans RFC 7932 Brotli, which is exactly whatBrotliState::new_strictdecodes. Node's decoder also rejects large windows by default. The new testlarge_window_brotli_is_rejectedfails if the decoder goes back tonew.brotli-decompressor 5.0.3 → 6.2.0. 6.x has fixes that 5.0.3 lacks:
6.2.0 is the newest release past the seven-day soak. 6.3.0 is 46 hours old and contains only performance work, with no security fixes.
brotli (dev-only) 8.0.4 → 9.1.1, the latest release.
Neither crate has a RustSec or GitHub advisory.
cargo denypasses, and the soak check passes with 0 exceptions.Closes #112.