From 15a422cee13237b61a200c20f2a969ffe4d1bd33 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Wed, 9 Sep 2026 12:29:55 +0200 Subject: [PATCH] package/turbolua: security bump version to 2.1.5 https://github.com/kernelsauce/turbo/releases/tag/v2.1.5 https://github.com/kernelsauce/turbo/releases/tag/v2.1.4 Security fixes: HTTP header injection: header values were only checked for a literal \r\n, so a lone \r or \n could still split a header. Now rejected on either character. Transfer-Encoding requests are now rejected with 501 instead of silently mishandled, closing a request smuggling avenue. A real default request body size cap (128 MB) with a 413 response, previously unbounded. Secure cookie signature now binds the cookie name, so a value signed for one cookie can no longer be replayed under a different name. Verification failures return the default value instead of raising. Constant-time comparison for the secure cookie HMAC, previously a timing-leaky ==. util.secure_random_bytes reads real OS entropy (/dev/urandom, BCryptGenRandom on Windows) for WebSocket masks and util.rand_str, previously math.random. WebSocket: unmasked client frames are rejected per RFC 6455, and fragmented message reassembly is capped to max_buffer_size to close a memory exhaustion path. StaticFileHandler decodes the request path before the traversal check, closing a bypass. Fixed a 32-byte-per-malformed-request memory leak in the C header parser wrapper (found via libFuzzer). Signed-off-by: Bernd Kuhls Signed-off-by: Julien Olivain --- package/turbolua/turbolua.hash | 2 +- package/turbolua/turbolua.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/turbolua/turbolua.hash b/package/turbolua/turbolua.hash index 12c41c6e5c..253b12e47b 100644 --- a/package/turbolua/turbolua.hash +++ b/package/turbolua/turbolua.hash @@ -1,3 +1,3 @@ # Locally calculated -sha256 4dbfbe4919118977c2ca40a4da81054ffe407d09f38bf5420eec5ae1449299d3 turbolua-2.1.3.tar.gz +sha256 65b602ae0638bd14405567de999ef57e8d49f0c8ebfa3561952f4ae7242e9d0c turbolua-2.1.5.tar.gz sha256 cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30 LICENSE diff --git a/package/turbolua/turbolua.mk b/package/turbolua/turbolua.mk index a85256a3e1..6765654afa 100644 --- a/package/turbolua/turbolua.mk +++ b/package/turbolua/turbolua.mk @@ -4,7 +4,7 @@ # ################################################################################ -TURBOLUA_VERSION = 2.1.3 +TURBOLUA_VERSION = 2.1.5 TURBOLUA_SITE = $(call github,kernelsauce,turbo,v$(TURBOLUA_VERSION)) TURBOLUA_DEPENDENCIES = luajit TURBOLUA_LICENSE = Apache-2.0