Thanks to visit codestin.com
Credit goes to github.com

Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: andy-maier/client_python
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: master
Choose a base ref
...
head repository: andy-maier/client_python
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 0.20.0.post1
Choose a head ref
  • 2 commits
  • 3 files changed
  • 1 contributor

Commits on Jul 29, 2024

  1. Reject invalid HTTP methods and resources 

    This change addresses the issue that currently, any HTTP method is handled
by returning success and metrics data, which causes network scanners to
report issues.

Details:

* This change rejects any HTTP methods and resources other than the following:

    OPTIONS (any) - returns 200 and an 'Allow' header indicating allowed methods
    GET (any) - returns 200 and metrics
    GET /favicon.ico - returns 200 and no body (this is no change)

  Other HTTP methods than these are rejected with 405 "Method Not Allowed"
  and an 'Allow' header indicating the allowed HTTP methods.

  Any returned HTTP errors are also displayed in the response body after a
  hash sign and with a brief hint,
  e.g. "# HTTP 405 Method Not Allowed: XXX; use OPTIONS or GET".

* Needed to pin asgiref to ==3.6.0 also for py3.8 to circumvent
  the same error as for pypy3.8.

Signed-off-by: Andreas Maier <[email protected]>
    @andy-maier
    andy-maier committed Jul 29, 2024
    Configuration menu
    Copy the full SHA
    f2156ae View commit details
    Browse the repository at this point in the history

  2. Removed CBC ciphers to address CVE-2013-0169 (LUCKY13) 

    Details:

* This change removes the following CBC ciphers from the default set
  of ciphers in order to address CVE-2013-0169 (LUCKY13):
  - ECDHE-ECDSA-AES256-SHA384
  - ECDHE-RSA-AES256-SHA384
  - ECDHE-ECDSA-AES128-SHA256
  - ECDHE-RSA-AES128-SHA256
  This is done by listing them in the code, i.e. without any way to
  configure that by the user.

Signed-off-by: Andreas Maier <[email protected]>
    @andy-maier
    andy-maier committed Jul 29, 2024
    Configuration menu
    Copy the full SHA
    affd81f View commit details
    Browse the repository at this point in the history
Loading