{"push_id":1209894176,"size":5,"distinct_size":5,"ref":"refs/heads/header_rules","head":"2b28fd85b560a53f7724b999eb1137ba7a077ed0","before":"f2e55a71d9b357902bda9672b75fa97d9dd5f694","commits":[{"sha":"0472dc2cfcc09af7242994c4b2dfe68b615c18dc","author":{"name":"Steffen Prince","email":"3ab7bc6ef86564729f2f3eced071cb0672f20e8d@sprin.io"},"message":" Use new schema to apply response header rules in bridge\n\nResponse headers are filtered to the prefixed/whitelisted headers.\nThis is done for the sake of having the correct headers in the RPC\nresponse, not for security. The bridge, belonging to the grain,\ncannot be trusted to implement security policy with respect to the\nresponse.","distinct":true,"url":"https://api.github.com/repos/sprin/sandstorm/commits/0472dc2cfcc09af7242994c4b2dfe68b615c18dc"},{"sha":"5ee9cb1e5d47d4e9a5135b2ec59e330799b46d62","author":{"name":"Steffen Prince","email":"3ab7bc6ef86564729f2f3eced071cb0672f20e8d@sprin.io"},"message":"Use new schema to apply request header rules in proxy\n\nPrefixed headers are allowed through.","distinct":true,"url":"https://api.github.com/repos/sprin/sandstorm/commits/5ee9cb1e5d47d4e9a5135b2ec59e330799b46d62"},{"sha":"39ac943700710d9548316c4447fe1b981629c870","author":{"name":"Steffen Prince","email":"3ab7bc6ef86564729f2f3eced071cb0672f20e8d@sprin.io"},"message":"Use new schema to apply response header rules in proxy","distinct":true,"url":"https://api.github.com/repos/sprin/sandstorm/commits/39ac943700710d9548316c4447fe1b981629c870"},{"sha":"ca3b4bab57eaf6824a2180237e4c6ba29a0f7a6e","author":{"name":"Steffen Prince","email":"3ab7bc6ef86564729f2f3eced071cb0672f20e8d@sprin.io"},"message":"Validate names and values of additional headers against RFC\n\nTo prevent header injection from maliciously-crafted capnp messages,\nwe need to validate that header names and values are valid\naccording to RFC 7230. Otherwise, a malicious capnp message could\ncontain a header name or value with a newline that when translated\nto HTTP, results in setting a different header field.","distinct":true,"url":"https://api.github.com/repos/sprin/sandstorm/commits/ca3b4bab57eaf6824a2180237e4c6ba29a0f7a6e"},{"sha":"2b28fd85b560a53f7724b999eb1137ba7a077ed0","author":{"name":"Steffen Prince","email":"3ab7bc6ef86564729f2f3eced071cb0672f20e8d@sprin.io"},"message":"Move header prefix whitelist into separate list\n\nThis change is made for simplifying the implementation of\nthe prefix check in sandstorm-http-bridge and in proxy.js.\nEfficiency is also improved by avoiding runtime checks on\nwhitelist entries to see if they are prefixes.","distinct":true,"url":"https://api.github.com/repos/sprin/sandstorm/commits/2b28fd85b560a53f7724b999eb1137ba7a077ed0"}]}
{"actor":{"display_login":"sprin"}}