Upgrade uWebSockets to v20.80.0 - #1254
Conversation
Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
🤖 Augment PR SummarySummary: This PR updates the vendored uWebSockets dependency from v20.79.0 to v20.80.0. Changes:
🤖 Was this summary useful? React with 👍 or 👎 |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
| return; | ||
| } | ||
| data.remove_prefix(1); | ||
| state += 2; |
There was a problem hiding this comment.
In vendor/uwebsockets/src/ChunkedEncoding.h:136, a size of ffffffffffffff fills the 56-bit size field; state += 2 carries into STATE_EXTENSION_IN_NAME, which is then cleared, leaving a size of 1. The parser can therefore accept and reframe an enormous chunk as one byte, enabling request-framing desynchronization.
Severity: high
Other Locations
vendor/uwebsockets/src/ChunkedEncoding.h:105vendor/uwebsockets/src/ChunkedEncoding.h:184
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
| if (transferEncodingString.data() != nullptr) { | ||
|
|
||
| /* We only support chunked */ | ||
| if (transferEncodingString != "chunked") { |
There was a problem hiding this comment.
In vendor/uwebsockets/src/HttpParser.h:584, transfer-coding names are case-insensitive, but this comparison only permits lower-case chunked; a conforming Transfer-Encoding: Chunked is rejected with 400.
Severity: medium
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
| if (transferEncodingString.data() != nullptr) { | ||
|
|
||
| /* We only support chunked */ | ||
| if (transferEncodingString != "chunked") { |
There was a problem hiding this comment.
In vendor/uwebsockets/src/HttpParser.h:584, getHeader returns only the first field value, so Transfer-Encoding: chunked followed by Transfer-Encoding: gzip passes this test although the combined coding does not end in chunked. The server then frames it as chunked, which can desynchronize it from intermediaries that process both fields.
Severity: high
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Benchmark (community)
Details
| Benchmark suite | Current: 02c159c | Previous: 44f9737 | Ratio |
|---|---|---|---|
Add one schema (0 existing) |
441 ms |
288 ms |
1.53 |
Add one schema (100 existing) |
33 ms |
32 ms |
1.03 |
Add one schema (1000 existing) |
92 ms |
84 ms |
1.10 |
Add one schema (10000 existing) |
776 ms |
623 ms |
1.25 |
Update one schema (1 existing) |
28 ms |
26 ms |
1.08 |
Update one schema (101 existing) |
32 ms |
32 ms |
1 |
Update one schema (1001 existing) |
104 ms |
78 ms |
1.33 |
Update one schema (10001 existing) |
775 ms |
1151 ms |
0.67 |
Cached rebuild (1 existing) |
8 ms |
8 ms |
1 |
Cached rebuild (101 existing) |
9 ms |
9 ms |
1 |
Cached rebuild (1001 existing) |
35 ms |
25 ms |
1.40 |
Cached rebuild (10001 existing) |
211 ms |
232 ms |
0.91 |
Index 100 schemas |
617 ms |
476 ms |
1.30 |
Index 1000 schemas |
1428 ms |
1206 ms |
1.18 |
Index 10000 schemas |
11995 ms |
10276 ms |
1.17 |
Index 10000 schemas (custom meta-schema) |
14060 ms |
12513 ms |
1.12 |
Index 10000 schemas ($ref fan-out) |
20403 ms |
12975 ms |
1.57 |
test/e2e/html: Schema Fetch (p50) |
285 us |
301 us |
0.95 |
test/e2e/html: Schema Fetch (p99) |
377 us |
375 us |
1.01 |
This comment was automatically generated by workflow using github-action-benchmark.
There was a problem hiding this comment.
Benchmark (enterprise)
Details
| Benchmark suite | Current: 02c159c | Previous: 44f9737 | Ratio |
|---|---|---|---|
Add one schema (0 existing) |
378 ms |
335 ms |
1.13 |
Add one schema (100 existing) |
121 ms |
101 ms |
1.20 |
Add one schema (1000 existing) |
175 ms |
157 ms |
1.11 |
Add one schema (10000 existing) |
813 ms |
855 ms |
0.95 |
Update one schema (1 existing) |
111 ms |
89 ms |
1.25 |
Update one schema (101 existing) |
123 ms |
100 ms |
1.23 |
Update one schema (1001 existing) |
177 ms |
153 ms |
1.16 |
Update one schema (10001 existing) |
831 ms |
923 ms |
0.90 |
Cached rebuild (1 existing) |
14 ms |
12 ms |
1.17 |
Cached rebuild (101 existing) |
14 ms |
12 ms |
1.17 |
Cached rebuild (1001 existing) |
45 ms |
36 ms |
1.25 |
Cached rebuild (10001 existing) |
350 ms |
279 ms |
1.25 |
Index 100 schemas |
615 ms |
528 ms |
1.16 |
Index 1000 schemas |
1553 ms |
1763 ms |
0.88 |
Index 10000 schemas |
13044 ms |
13621 ms |
0.96 |
Index 10000 schemas (custom meta-schema) |
15551 ms |
17177 ms |
0.91 |
Index 10000 schemas ($ref fan-out) |
15716 ms |
15615 ms |
1.01 |
enterprise/e2e/auth: Schema Anonymous (p50) |
382 us |
291 us |
1.31 |
enterprise/e2e/auth: Schema Anonymous (p99) |
485 us |
395 us |
1.23 |
enterprise/e2e/auth: Schema API Key Identity (p50) |
388 us |
294 us |
1.32 |
enterprise/e2e/auth: Schema API Key Identity (p99) |
482 us |
395 us |
1.22 |
enterprise/e2e/auth: Schema API Key SHA256 (p50) |
396 us |
301 us |
1.32 |
enterprise/e2e/auth: Schema API Key SHA256 (p99) |
503 us |
385 us |
1.31 |
enterprise/e2e/auth: Schema JWT (p50) |
542 us |
408 us |
1.33 |
enterprise/e2e/auth: Schema JWT (p99) |
721 us |
524 us |
1.38 |
test/e2e/html: Schema Fetch (p50) |
383 us |
298 us |
1.29 |
test/e2e/html: Schema Fetch (p99) |
478 us |
356 us |
1.34 |
This comment was automatically generated by workflow using github-action-benchmark.
1 participant
Signed-off-by: Juan Cruz Viotti jv@jviotti.com