Anole 0.1.1

Anole 0.1.1 is a security release. Everyone on 0.1.0 should upgrade.

Before building the language bindings on top of Anole, I had the whole codebase reviewed for security. The review found 1 critical, 13 high, 25 medium and 29 low-severity problems, and this release fixes all of them. I reproduced each one with a failing test before fixing it, and added fuzz targets where a parser was involved. Two of the problems were in dependencies, zig-protobuf and pg.zig. I told their maintainers privately before this release. Anole now pins patched forks of both, and the zig-protobuf fix is upstream as Arwalk/zig-protobuf#191.

The 30 advisories are listed on the Security tab. The full list, finding by finding, is in CHANGELOG.md.

Upgrade

zig fetch --save git+https://github.com/xuckless/anole#v0.1.1

Some fixes change defaults or refuse input that 0.1.0 accepted. Check the breaking changes below before you deploy.

Breaking changes

Each item is described in the changelog.

• Server: res.header/res.addHeader refuse Transfer-Encoding and
  Connection (use res.keepalive = false); HTTP/1.1 requests without
  exactly one Host get 400 (request.require_host = false restores the
  old behaviour); X-Forwarded-Host needs trust_forwarded_host = true;
  a malformed request body reads as error.MalformedBody.
• http3.hq_interop_root needs pub const anole_hq_interop = true; in the
  root file.
• TLS 1.2 listeners accept only ECDHE with AES-GCM or ChaCha20-Poly1305.
• HTTP client: URLs with raw spaces, control characters or non-ASCII bytes
  in the path or query fail with error.InvalidUrl; a 307/308 that would
  carry the body to another host is not followed. StreamError gains
  HeadersTooLarge and TooManyInterimResponses.
• JSON: json.Error gains NestingTooDeep.
• gRPC: a call receives at most 64 MiB in all on the server
  (RegisterOptions.max_received_bytes) and on the client
  (Channel.max_received_bytes); Call.addTrailer refuses invalid
  metadata (use addBinaryTrailer for raw bytes); transcoded bindings with
  a body answer 415 to a non-JSON Content-Type.
• WebSocket and WebTransport: handshakes from another origin get 403 unless
  listed in allowed_origins; Rooms.broadcast returns the number of
  members it queued for.
• Sessions: signed session cookies from 0.1.0 are refused (users sign in
  again); cookie_opts is now SessionCookieOpts; custom session stores
  should implement Store.VTable.update and touch.
• Auth: a JWKS Keyring policy needs an audience (or
  allow_any_audience = true); OIDC discovery refuses non-https
  endpoints; apikey.generate can return error.EntropyUnavailable;
  rate-limit keys of IPv6 clients are their /64.
• Logs: access logs leave the query string out unless log_query = true;
  incoming request IDs outside [A-Za-z0-9._:-] are replaced.
• Databases: PostgreSQL defaults to sslmode=verify-full for remote servers
  and sends clear-text or MD5 passwords only to a verified or local server;
  SQLite treats file: paths as URIs only with Options.uri = true.
• examples/rest reads its API key from the API_KEY environment variable.

Also new in 0.1.1

• libanole, a preview of the C ABI (include/anole.h, zig build capi): the base for the coming Node and Python bindings. ABI 0.x, so there is no stability promise yet. See docs/c-abi.md.
• Detached responses in the HTTP core: an HTTP/2 or HTTP/3 request that arrived whole can be answered later, with no task waiting.
• Dual-stack listeners: listen(":3000") takes both IPv6 and IPv4 clients. This changes behaviour: ":3000" used to mean 0.0.0.0.
• Result cache: .keep_empty and anole.db.lastSource(req).
• Windows as a development target: the library, the examples and the tests build and run there. Production stays Linux.

Known issue: a program that links the static libanole.a with dead-stripping (-Wl,-dead_strip on macOS) crashes when it starts a TLS listener. A fix is in progress. The Zig package is not affected.