Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update github.com/rs/cors to v1.11.0 #3884

Merged
merged 1 commit into from
Sep 11, 2024
Merged

Update github.com/rs/cors to v1.11.0 #3884

merged 1 commit into from
Sep 11, 2024

Conversation

ccorbo
Copy link
Contributor

@ccorbo ccorbo commented Aug 26, 2024 •
edited
Loading

update github.com/rs/cors to v1.11.0

Related: prebid/prebid-cache#177

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include an Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

@bsardo bsardo self-assigned this Sep 3, 2024
@bsardo bsardo changed the title update github.com/rs/cors to v1.11.0 Update github.com/rs/cors to v1.11.0 Sep 3, 2024
bsardo
bsardo approved these changes Sep 3, 2024
View reviewed changes
Copy link
Collaborator

@bsardo bsardo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. I'm curious though why a PR wasn't automatically opened by dependabot given that we have its alerts enabled.

@bsardo bsardo assigned hhhjort and przemkaczmarek and unassigned hhhjort Sep 9, 2024
@bsardo bsardo merged commit 6a011ed into prebid:master Sep 11, 2024
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bsardo bsardo bsardo approved these changes

@przemkaczmarek przemkaczmarek przemkaczmarek approved these changes

Assignees

@bsardo bsardo

@przemkaczmarek przemkaczmarek

Labels
do not port
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@ccorbo @bsardo @przemkaczmarek @hhhjort