http: do not allow OBS fold in headers by default

PR-URL: nodejs-private/node-private#557 Refs: nodejs-private/node-private#556 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> CVE-ID: CVE-2024-27982
nodejs · Apr 2, 2024 · 5e34540 · 5e34540
1 parent bd8f10a
commit 5e34540
Show file tree

Hide file tree

Showing 6 changed files with 1,030 additions and 601 deletions.
diff --git a/deps/llhttp/CMakeLists.txt b/deps/llhttp/CMakeLists.txt
@@ -1,7 +1,7 @@
 cmake_minimum_required(VERSION 3.5.1)
 cmake_policy(SET CMP0069 NEW)
 
-project(llhttp VERSION 8.1.1)
+project(llhttp VERSION 8.1.2)
 include(GNUInstallDirs)
 
 set(CMAKE_C_STANDARD 99)

diff --git a/deps/llhttp/README.md b/deps/llhttp/README.md
@@ -345,17 +345,34 @@ make
 
 ### Using with CMake
 
-If you want to use this library in a CMake project you can use the snippet below.
+If you want to use this library in a CMake project as a shared library, you can use the snippet below.
 
 ```
 FetchContent_Declare(llhttp
-  URL "https://github.com/nodejs/llhttp/archive/refs/tags/v6.0.5.tar.gz")  # Using version 6.0.5
+  URL "https://github.com/nodejs/llhttp/archive/refs/tags/release/v8.1.0.tar.gz")
 
 FetchContent_MakeAvailable(llhttp)
 
-target_link_libraries(${EXAMPLE_PROJECT_NAME} ${PROJECT_LIBRARIES} llhttp ${PROJECT_NAME})
+# Link with the llhttp_shared target
+target_link_libraries(${EXAMPLE_PROJECT_NAME} ${PROJECT_LIBRARIES} llhttp_shared ${PROJECT_NAME})
 ```
 
+If you want to use this library in a CMake project as a static library, you can set some cache variables first.
+
+```
+FetchContent_Declare(llhttp
+  URL "https://github.com/nodejs/llhttp/archive/refs/tags/release/v8.1.0.tar.gz")
+
+set(BUILD_SHARED_LIBS OFF CACHE INTERNAL "")
+set(BUILD_STATIC_LIBS ON CACHE INTERNAL "")
+FetchContent_MakeAvailable(llhttp)
+
+# Link with the llhttp_static target
+target_link_libraries(${EXAMPLE_PROJECT_NAME} ${PROJECT_LIBRARIES} llhttp_static ${PROJECT_NAME})
+```
+
+_Note that using the git repo directly (e.g., via a git repo url and tag) will not work with FetchContent_Declare because [CMakeLists.txt](./CMakeLists.txt) requires string replacements (e.g., `_RELEASE_`) before it will build._
+
 ## Building on Windows
 
 ### Installation

diff --git a/deps/llhttp/include/llhttp.h b/deps/llhttp/include/llhttp.h
@@ -3,7 +3,7 @@
 
 #define LLHTTP_VERSION_MAJOR 8
 #define LLHTTP_VERSION_MINOR 1
-#define LLHTTP_VERSION_PATCH 1
+#define LLHTTP_VERSION_PATCH 2
 
 #ifndef LLHTTP_STRICT_MODE
 # define LLHTTP_STRICT_MODE 0