The Wayback Machine - https://web.archive.org/web/20220208183220/https://github.com/dotnet/aspnetcore/pull/40073
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merging internal commits for release/6.0 #40073

Open
wants to merge 27 commits into
base: release/6.0
Choose a base branch
from

Conversation

@vseanreesermsft
Copy link

@vseanreesermsft vseanreesermsft commented Feb 8, 2022

No description provided.

dotnet-bot and others added 27 commits Dec 1, 2021
… HTTP/3 request headers

MSRC Case Opened: 68921 - ASP.NET  Core - Kestrel overpooling of HTTP/2 and HTTP/3 request headers leads to DoS CRM:0802002372

Summary of the changes (Less than 80 chars)

## Description

Kestrel now correctly calls OnHeadersComplete after parsing request headers so unused headers are removed from headers collection. Prevents headers building up over time and exhausting memory.

## Customer Impact

Potential DoS attack

## Regression?

- [ ] Yes
- [x] No

[If yes, specify the version the behavior has regressed from]

## Risk

- [ ] High
- [x] Medium
- [ ] Low

The change is small but this code is on the critical path of a request. It is executed with every HTTP/2 and HTTP/3 request.

## Verification

- [X] Manual (required)
- [x] Automated

## Packaging changes reviewed?

- [ ] Yes
- [ ] No
- [x] N/A

----

## When servicing release/2.1

- [ ] Make necessary changes in eng/PatchConfig.props
…t-runtime dnceng/internal/dotnet-efcore

 - Fixup

 - Fixup

 - Remove dotnetcliruntime, fix extension

 - Make sure dotnetcliruntime is set

 - !fixup! Remove extra `?` from URI

 - Download Runtime correlation payload

 - Move from alpine 3.9 to 3.14
…t-efcore dnceng/internal/dotnet-runtime

 - Pass feed properties to source-build

 - Point helix.proj dotnetcli payload to dotnetbuilds/internal

 - Update RuntimeSourceFeed and RuntimeSourceFeedKey for dotnetbuilds

 - Change `$(DotNetPrivateAssetRootUrl)`
@msftbot msftbot bot added this to the 6.0.x milestone Feb 8, 2022
@msftbot msftbot bot added this to In Progress in Servicing Feb 8, 2022
@msftbot
Copy link
Contributor

@msftbot msftbot bot commented Feb 8, 2022

Hi @vseanreesermsft. If this is not a tell-mode PR, please make sure to follow the instructions laid out in the servicing process document.
Otherwise, please add tell-mode label.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Servicing
In Progress
Linked issues

Successfully merging this pull request may close these issues.

None yet

3 participants