From 9d9b24ef987b53e54377415d6d0c7e419c89e8fb Mon Sep 17 00:00:00 2001 From: Jose Quintana Date: Sun, 17 Apr 2022 01:24:23 +0200 Subject: [PATCH] v2.7.1 --- CHANGELOG.md | 17 +++++++++++++++++ Cargo.lock | 2 +- Cargo.toml | 2 +- 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 13c8aa8..0f16df9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 _**Note:** See changelog for v1 under the [1.x](https://github.com/joseluisq/static-web-server/blob/1.x/CHANGELOG.md) branch._ +## v2.7.1 - 2022-04-17 + +__Fixes__ + +- [9c58496](https://github.com/joseluisq/static-web-server/commit/9c58496) Bugfix/security dependency updates including httparse, flate2, h2, tracing, brotli, windows-rs and other crates (also [bc62634](https://github.com/joseluisq/static-web-server/commit/bc62634), [8a1d1cb](https://github.com/joseluisq/static-web-server/commit/8a1d1cb), [eabc559](https://github.com/joseluisq/static-web-server/commit/eabc559)). +- [041f0f8](https://github.com/joseluisq/static-web-server/commit/041f0f8) Prevent arbitrary files access on Windows.
+ It mitigates accessing files outside of server root directory on Windows when a driver label is used as part of a request URL.
+ E.g `http://localhost:1234/whatever/c:/windows/win.ini`. + +__Refactorings__ + +- [fa05773](https://github.com/joseluisq/static-web-server/commit/fa05773) Small performance improvement for tracing. + +__Docs__ + +- [9c58496](https://github.com/joseluisq/static-web-server/commit/9c58496) Build documentation from source. + ## v2.7.0 - 2022-03-21 __Fixes__ diff --git a/Cargo.lock b/Cargo.lock index 69202be..a1ca392 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -868,7 +868,7 @@ checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d" [[package]] name = "static-web-server" -version = "2.7.0" +version = "2.7.1" dependencies = [ "anyhow", "async-compression", diff --git a/Cargo.toml b/Cargo.toml index 1f46446..58446e1 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "static-web-server" -version = "2.7.0" +version = "2.7.1" authors = ["Jose Quintana "] license = "MIT OR Apache-2.0" description = "A blazing fast and asynchronous web server for static files-serving." -- libgit2 1.7.2