Skip to content

0.5.2

Choose a tag to compare

View all tags
@pepone pepone released this 18 May 17:52
· 471 commits to main since this release
v0.5.2
8d3b938

What's Changed

Hardening against malformed requests and responses

Most of this release tightens how IceRPC reacts to invalid or malicious input on the wire. If you expose an IceRPC server to untrusted clients (or talk to untrusted servers), you should upgrade to this release:

  • The Slice decoder now rejects truncated bit sequences, duplicate dictionary keys, and malformed URI-based server addresses.
  • The icerpc protocol rejects requests with invalid paths, duplicate header field keys, or trailing bytes in the request context field.
  • Protobuf rejects trailing bytes in unary payloads and validates envelopes more strictly.
  • Slic bounds the size of stream and control frame bodies, gap-checks the first remote stream ID, and correctly handles peer window overflow.

Behavior changes to be aware of when upgrading

  • Deadlines beyond the supported maximum are now rejected with an error.
  • The telemetry interceptor forces the W3C activity ID format on outgoing requests.

Full Changelog

v0.5.1...v0.5.2

Assets 2
Loading