Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace http_parser.rb with llhttp or other equivalents #3437

Open
ashie opened this issue Jun 30, 2021 · 0 comments
Open

Replace http_parser.rb with llhttp or other equivalents #3437

ashie opened this issue Jun 30, 2021 · 0 comments
Assignees

Comments

@ashie
Copy link
Member

ashie commented Jun 30, 2021

Describe the bug
Fluentd depends on http_parser.rb but it's not maintained and not released new version since December 11, 2013.
In this gem, vulnerability is often detected mistakenly by several security tools because it includes a garbage Gemfile.lock. e.g.) #3409 #3374

I'm troublesome to support such issue, so that I've gotten ownership of http_parser.rb and I'll release a new gem which fixes this issue. Although such false positive will be suppressed by it, we should consider replacing http_parser.rb with other equivalents such as llhttp because dependent http-parser is already dead too.

To Reproduce
See https://github.com/nodejs/http-parser

http-parser is not actively maintained. New projects and projects looking to migrate should consider llhttp.

Expected behavior
Dependent libraries should be well maintained.

Your Environment
N/A

Your Configuration
N/A

Your Error Log
N/A

Additional context
N/A

@ashie ashie self-assigned this Jun 30, 2021
ashie added a commit that referenced this issue Jul 8, 2021
http_parser.rb 0.6.0 includes a garbage Gemfile.lock and it causes false
positive detection by security scanning tools. 0.7.0 fixes this issue.

See also: #3374 #3409 #3437

Signed-off-by: Takuro Ashie <ashie@clear-code.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant