Update dependency aiohttp to v3.9.4 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
aiohttp	==3.9.2 -> ==3.9.4

GitHub Vulnerability Alerts

CVE-2024-27306

Summary

A XSS vulnerability exists on index pages for static file handling.

Details

When using web.static(..., show_index=True), the resulting index pages do not escape file names.

If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks.

Workaround

We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected.

Other users can disable show_index if unable to upgrade.

---

Patch: https://github.com/aio-libs/aiohttp/pull/8319/files

CVE-2024-30251

Summary

An attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests.

Impact

An attacker can stop the application from serving requests after sending a single request.

---

For anyone needing to patch older versions of aiohttp, the minimum diff needed to resolve the issue is (located in _read_chunk_from_length()):

diff --git a/aiohttp/multipart.py b/aiohttp/multipart.py
index 227be605c..71fc2654a 100644
--- a/aiohttp/multipart.py
+++ b/aiohttp/multipart.py
@​@​ -338,6 +338,8 @​@​ class BodyPartReader:
         assert self._length is not None, "Content-Length required for chunked read"
         chunk_size = min(size, self._length - self._read_bytes)
         chunk = await self._content.read(chunk_size)
+        if self._content.at_eof():
+            self._at_eof = True
         return chunk
 
     async def _read_chunk_from_stream(self, size: int) -> bytes:

This does however introduce some very minor issues with handling form data. So, if possible, it would be recommended to also backport the changes in:
aio-libs/aiohttp@cebe526
aio-libs/aiohttp@7eecdff
aio-libs/aiohttp@f21c6f2

---

Release Notes

aio-libs/aiohttp (aiohttp)

v3.9.4

Compare Source

==================

Bug fixes

• The asynchronous internals now set the underlying causes
  when assigning exceptions to the future objects
  -- by :user:webknjaz.

  Related issues and pull requests on GitHub:
  :issue:8089.

• Treated values of Accept-Encoding header as case-insensitive when checking
  for gzip files -- by :user:steverep.

  Related issues and pull requests on GitHub:
  :issue:8104.

• Improved the DNS resolution performance on cache hit -- by :user:bdraco.

  This is achieved by avoiding an :mod:asyncio task creation in this case.

  Related issues and pull requests on GitHub:
  :issue:8163.

• Changed the type annotations to allow dict on :meth:aiohttp.MultipartWriter.append,
  :meth:aiohttp.MultipartWriter.append_json and
  :meth:aiohttp.MultipartWriter.append_form -- by :user:cakemanny

  Related issues and pull requests on GitHub:
  :issue:7741.

• Ensure websocket transport is closed when client does not close it
  -- by :user:bdraco.

  The transport could remain open if the client did not close it. This
  change ensures the transport is closed when the client does not close
  it.

  Related issues and pull requests on GitHub:
  :issue:8200.

• Leave websocket transport open if receive times out or is cancelled
  -- by :user:bdraco.

  This restores the behavior prior to the change in #​7978.

  Related issues and pull requests on GitHub:
  :issue:8251.

• Fixed content not being read when an upgrade request was not supported with the pure Python implementation.
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:8252.

• Fixed a race condition with incoming connections during server shutdown -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:8271.

• Fixed multipart/form-data compliance with :rfc:7578 -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:8280.

• Fixed blocking I/O in the event loop while processing files in a POST request
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:8283.

• Escaped filenames in static view -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:8317.

• Fixed the pure python parser to mark a connection as closing when a
  response has no length -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:8320.

Features

• Upgraded llhttp to 9.2.1, and started rejecting obsolete line folding
  in Python parser to match -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:8146, :issue:8292.

Deprecations (removal in next major release)

• Deprecated content_transfer_encoding parameter in :py:meth:FormData.add_field() <aiohttp.FormData.add_field> -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:8280.

Improved documentation

• Added a note about canceling tasks to avoid delaying server shutdown -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:8267.

Contributor-facing changes

• The pull request template is now asking the contributors to
  answer a question about the long-term maintenance challenges
  they envision as a result of merging their patches
  -- by :user:webknjaz.

  Related issues and pull requests on GitHub:
  :issue:8099.

• Updated CI and documentation to use NPM clean install and upgrade
  node to version 18 -- by :user:steverep.

  Related issues and pull requests on GitHub:
  :issue:8116.

• A pytest fixture hello_txt was introduced to aid
  static file serving tests in
  :file:test_web_sendfile_functional.py. It dynamically
  provisions hello.txt file variants shared across the
  tests in the module.

  -- by :user:steverep

  Related issues and pull requests on GitHub:
  :issue:8136.

Packaging updates and notes for downstreams

• Added an internal pytest marker for tests which should be skipped
  by packagers (use -m 'not internal' to disable them) -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:8299.

---

v3.9.3

Compare Source

==================

Bug fixes

• Fixed backwards compatibility breakage (in 3.9.2) of ssl parameter when set outside
  of ClientSession (e.g. directly in TCPConnector) -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:8097, :issue:8098.

Miscellaneous internal changes

• Improved test suite handling of paths and temp files to consistently use pathlib and pytest fixtures.

  Related issues and pull requests on GitHub:
  :issue:3957.

---

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.