c6b04dd33b
When handling HTTP headers, net/http does not currently limit the number of cookies that can be parsed. The only limitation that exists is for the size of the entire HTTP header, which is controlled by MaxHeaderBytes (defaults to 1 MB). Unfortunately, this allows a malicious actor to send HTTP headers which contain a massive amount of small cookies, such that as much cookies as possible can be fitted within the MaxHeaderBytes limitation. Internally, this causes us to allocate a massive number of Cookie struct. For example, a 1 MB HTTP header with cookies that repeats "a=;" will cause an allocation of ~66 MB in the heap. This can serve as a way for malicious actors to induce memory exhaustion. To fix this, we will now limit the number of cookies we are willing to parse to 3000 by default. This behavior can be changed by setting a new GODEBUG option: GODEBUG=httpcookiemaxnum. httpcookiemaxnum can be set to allow a higher or lower cookie limit. Setting it to 0 will also allow an infinite number of cookies to be parsed. Thanks to jub0bs for reporting this issue. For #75672 Fixes #75706 Fixes CVE-2025-58186 Change-Id: Ied58b3bc8acf5d11c880f881f36ecbf1d5d52622 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2720 Reviewed-by: Roland Shoemaker <bracewell@google.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2983 Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/709840 TryBot-Bypass: Michael Pratt <mpratt@google.com> Auto-Submit: Michael Pratt <mpratt@google.com> Reviewed-by: Carlos Amedee <carlos@golang.org> |
||
|---|---|---|
| .. | ||
| initial | ||
| asm.html | ||
| go1.17_spec.html | ||
| go_mem.html | ||
| go_spec.html | ||
| godebug.md | ||
| README.md | ||
Release Notes
The initial and next subdirectories of this directory are for release notes.
For developers
Release notes should be added to next by editing existing files or creating
new files. Do not add RELNOTE=yes comments in CLs. Instead, add a file to
the CL (or ask the author to do so).
At the end of the development cycle, the files will be merged by being concatenated in sorted order by pathname. Files in the directory matching the glob "*stdlib/*minor" are treated specially. They should be in subdirectories corresponding to standard library package paths, and headings for those package paths will be generated automatically.
Files in this repo's api/next directory must have corresponding files in
doc/next/*stdlib/*minor.
The files should be in the subdirectory for the package with the new
API, and should be named after the issue number of the API proposal.
For example, if the directory 6-stdlib/99-minor is present,
then an api/next file with the line
pkg net/http, function F #12345
should have a corresponding file named doc/next/6-stdlib/99-minor/net/http/12345.md.
At a minimum, that file should contain either a full sentence or a TODO,
ideally referring to a person with the responsibility to complete the note.
If your CL addresses an accepted proposal, mention the proposal issue number in
your release note in the form /issue/NUMBER. A link to the issue in the text
will have this form (see below). If you don't want to mention the issue in the
text, add it as a comment:
<!-- go.dev/issue/12345 -->
If an accepted proposal is mentioned in a CL but not in the release notes, it will be flagged as a TODO by the automated tooling. That is true even for proposals that add API.
Use the following forms in your markdown:
[http.Request] # symbol documentation; auto-linked as in Go doc strings
[Request] # short form, for symbols in the package being documented
[net/http] # package link
[#12345](/issue/12345) # GitHub issues
[CL 6789](/cl/6789) # Gerrit changelists
To preview next content in merged form using a local instance of the website, run:
go run golang.org/x/website/cmd/golangorg@latest -goroot=..
Then open http://localhost:6060/doc/next. Refresh the page to see your latest edits.
For the release team
The relnote tool, at golang.org/x/build/cmd/relnote, operates on the files
in doc/next.
As a release cycle nears completion, run relnote todo to get a list of
unfinished release note work.
To prepare the release notes for a release, run relnote generate.
That will merge the .md files in next into a single file.
Atomically (as close to it as possible) add that file to _content/doc directory
of the website repository and remove the doc/next directory in this repository.
To begin the next release development cycle, populate the contents of next
with those of initial. From the repo root:
> cd doc
> cp -R initial/ next
Then edit next/1-intro.md to refer to the next version.