| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
Reject header values holding a character above U+00FF (#13002) * Reject header values holding a character above U+00FF RFC 7230 defines a header value over octets (field-vchar = VCHAR / obs-text, obs-text being %x80-FF), so a character that is not representable as a single octet is not a header value at all. verifyValidHeaderValueCharSequence compared full char values and let everything from U+0100 up through. Nothing narrows such a char to a byte downstream, so this was not a response-splitting hole: Netty's encoders route through AsciiString.c2b, which substitutes '?' above 255, in the HTTP/1.1 request and response encoders and in the HPACK encoder alike, and the JDK HTTP client rejects the value from its own request builder. What the gap did produce was inconsistency - one transport silently mangled the value, the other threw from inside the client, far from the code that set the header. Reject the character where it is set instead, naming the header and the offending index like the other validation failures. Characters in %x80-FF stay valid obs-text, so a Content-Disposition filename using Latin-1 accented characters is unaffected; only characters above U+00FF are rejected, and those were already reaching the wire as '?'. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Cover the remaining header value validation branches The two conditions changed by this PR each carry branches that no test reached: a first character below 0x21 or equal to DEL, a horizontal tab inside a value (the one character below 0x20 that field-content allows), and a DEL after the first index. The boundary itself is now pinned from both sides, so U+00FF stays valid obs-text and U+0100 is rejected at index 0 and inside the value alike. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> | 1 天前 | |
Rename org.particleframework to io.micronaut | 8 年前 | |
New bean definition API (#12429) • New builder-based bean definition pipeline replaces the previous visitor/writer flow, aligning compile-time processors and runtime AOP with a shared abstraction. Core Builder API - Declared a complete builder contract under inject/src/main/java/io/micronaut/context/bean/definition/builder/ (e.g. `BeanDefinitionBuilder`, `ConstructorDefinition`) giving processors/runtime a stable way to register constructors, injections, lifecycle hooks, and proxies. - Provided `BeanDefinitionInjectionPoint.`to model value and bean injection metadata so downstream writers no longer synthesize this info ad hoc. Compile-Time Processor Changes - Replaced direct writer usage with the new builder via `ElementBeanDefinitionBuilder` and `DefaultElementBeanDefinitionBuilderFactory`, letting annotation visitors assemble definitions through uniform helper methods. - Added `BeanInjectionUtils` for shared creation of constructor/field/method definitions, consolidating logic previously scattered across creators. - Updated major generators (`BeanDefinitionWriter`, `AbstractBeanDefinitionBuilder`, `DispatchWriter`) to implement the builder interface, trimming legacy APIs (`ProxyingBeanDefinitionVisitor` removed) and clarifying state handling. - Adjusted visitors (`IntrospectedTypeElementVisitor`, `DeclaredBeanElementCreator`, `ConfigurationReaderBeanElementCreator`) to consume the new factory, ensuring configuration beans and introspections emit through the same pathway. AOP Runtime Integration - Added intercepted bean definition implementations (`aop/src/main/java/io/micronaut/aop/beandefinition/InterceptedInstantiateBeanDefinition`, `ProxyInterceptedInstantiateBeanDefinition`) that wrap the new builder output for constructor, initialize, and dispose flows. - Refactored `AopProxyWriter`, `ProxyingBeanDefinitionWriter`, and `RuntimeProxyBeanDefinitionWriter` to build proxies from the shared builder contract, retaining interceptor metadata while reducing duplication. - Minor tweaks in chains/registries (`ConstructorInterceptorChain`, `DefaultInterceptorRegistry`) to accommodate the new bean-definition shapes. --------- Co-authored-by: Graeme Rocher <graeme.rocher@oracle.com> | 2 个月前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 1 天前 | ||
| 8 年前 | ||
| 2 个月前 |