v0.7.0

Breaking change: srv now listens on 127.0.0.1 only, so other machines on the network can no longer connect by default. To open the pages from a phone or another computer, choose the address with the new -b, --bind option:

srv -b 0.0.0.0    # every IPv4 address
srv -b ::         # every IPv4 and IPv6 address, as before

This release also hardens the server:

• Named pipes and devices are no longer served. Opening a named pipe used to hang a connection, and with it the idle timeout.
• Requests with control characters or a NUL byte in the path are rejected. This closes a response-header injection and an escape-sequence injection into the log.
• Clients get 10 seconds to send a request, and are dropped if they stop reading for 30 seconds.
• At most 128 connections are handled at once; further connections get 503.
• A file that grows while being sent no longer produces a body longer than its Content-Length.
• Requests such as //docs no longer redirect to another host.

Release archives now come with a build provenance attestation. Check one with:

gh attestation verify srv-v0.7.0-<platform>.tar.gz --repo rognlien/srv

What's Changed

• Serve only regular files by @rognlien in #1
• Close the connection when its thread cannot start by @rognlien in #2
• Reject request lines with control characters by @rognlien in #3
• Reject NUL bytes in request paths by @rognlien in #4
• Collapse leading slashes in directory redirects by @rognlien in #5
• Format log timestamps with localtime_r by @rognlien in #6
• Send no more of a file than its Content-Length by @rognlien in #7
• Give clients 10 seconds in total to send the request head by @rognlien in #8
• Drop clients that stop reading for 30 seconds by @rognlien in #9
• Limit the server to 128 connections at a time by @rognlien in #10
• Pin GitHub Actions to commit SHAs by @rognlien in #11
• Add unit tests by @rognlien in #12
• Add end-to-end tests by @rognlien in #13
• Keep the pinned actions up to date with Dependabot by @rognlien in #15
• Attest the build provenance of release archives by @rognlien in #16
• Document the connection limits, timeouts and served files by @rognlien in #17
• Run the tests in CI by @rognlien in #14
• Listen on localhost by default and add -b to choose the address by @rognlien in #22
• Bump actions/checkout from 5.1.0 to 7.0.1 by @dependabot[bot] in #18
• Bump actions/setup-java from 5.7.0 to 6.0.1 by @dependabot[bot] in #19
• Bump actions/cache from 4.3.0 to 6.1.0 by @dependabot[bot] in #20
• Bump gradle/actions/setup-gradle from 5.0.2 to 6.4.0 by @dependabot[bot] in #21
• Use setup-gradle 6.4.0 in the tests too by @rognlien in #23

New Contributors

• @rognlien made their first contribution in #1
• @dependabot[bot] made their first contribution in #18

Full Changelog: v0.6.0...v0.7.0