f-denkena/rclone
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
21d8cd3b92cd81d987f485051d454ea675d91a2b
rclone/lib
T
History
Nick Craig-Wood 21d8cd3b92 lib/proxy: fix unbounded HTTP CONNECT headers causing OOM GHSA-xhf4-832v-7xcr CVE-PENDING 
Before this change rclone read a proxy response with http.ReadResponse
over an unrestricted buffered reader. A malicious or compromised
configured proxy, or an active on-path actor controlling a plaintext
HTTP-proxy hop, can grow memory until the process fails.

This fixes the problem by restrincting the read to 1MB maximum.
2026-07-31 13:21:59 +01:00
..
atexit
build: remove build constraint syntax for go 1.16 and older
2024-04-18 16:53:55 +02:00
batcher
build: modernize Go usage
2025-02-28 11:31:14 +00:00
bucket
lib/bucket: fix tidying of // in object keys #5858
2025-01-22 11:56:05 +00:00
buildinfo
docs: fix code comment regarding cmount tag
2026-04-20 20:09:52 +02:00
cache
build: modernize Go usage
2025-02-28 11:31:14 +00:00
caller
pacer: factor call stack searching into its own package
2025-11-12 12:22:04 +00:00
daemonize
build: enable support for aix/ppc64
2025-10-27 13:34:58 +00:00
debug
build: update to go1.21rc3 and make go1.19 the minimum required version
2023-07-16 10:09:25 +01:00
dircache
dircache: allow empty string as root parent id
2026-01-08 12:05:37 +00:00
diskusage
Add lib/diskusage to measure used/free on disks
2023-09-07 15:57:45 +01:00
encoder
build: use sequence Split introduced in go1.24
2025-09-15 12:45:57 +01:00
env
docs: punctuation cleanup
2021-10-20 22:56:19 +02:00
errcount
errcount: factor errcount abstraction from operations
2024-02-22 11:13:54 +00:00
errors
build: modernize Go code with go fix for go1.25
2026-02-18 12:11:52 +00:00
exitcode
cmd: change exit code from 1 to 2 for syntax and usage errors
2024-09-20 18:51:08 +02:00
file
build: make go1.23 the minimum go version
2025-02-26 18:00:58 +00:00
http
http: add Prefer to CORS Access-Control-Allow-Headers header
2026-07-17 11:55:33 +01:00
israce
build: remove build constraint syntax for go 1.16 and older
2024-04-18 16:53:55 +02:00
jwtutil
build: modernize Go usage
2025-02-28 11:31:14 +00:00
kv
config: make parsing of duration options consistent
2025-07-08 12:08:14 +02:00
mmap
build: modernize benchmark usage
2025-09-15 12:45:57 +01:00
multipart
pool: fix deadlock with --max-memory and multipart transfers
2025-08-07 12:45:44 +01:00
oauthutil
fs: fix passwords and tokens appearing in the debug log during rclone config
2026-07-16 16:11:22 +01:00
pacer
build: modernize Go code with go fix for go1.25
2026-02-18 12:11:52 +00:00
plugin
build: remove build constraint syntax for go 1.16 and older
2024-04-18 16:53:55 +02:00
pool
build: modernize Go code with go fix for go1.25
2026-02-18 12:11:52 +00:00
proxy
lib/proxy: fix unbounded HTTP CONNECT headers causing OOM GHSA-xhf4-832v-7xcr CVE-PENDING
2026-07-31 13:21:59 +01:00
random
build: modernize Go usage
2025-02-28 11:31:14 +00:00
ranges
build: modernize Go usage
2025-02-28 11:31:14 +00:00
readers
ftp: fix multi-thread copy
2024-01-03 12:21:08 +00:00
rest
webdav: fix HTTPS to HTTP redirects leaking credentials GHSA-h4mf-4v27-hggj
2026-07-31 13:21:59 +01:00
sdactivation
build: remove obsolete build tag
2025-10-21 18:56:06 +01:00
structs
build: modernize Go usage
2025-02-28 11:31:14 +00:00
systemd
build: update logging statements to make json log work - fixes #6038
2024-09-06 17:04:18 +01:00
terminal
Replace Windows-specific NewLazyDLL with NewLazySystemDLL
2025-01-08 17:35:00 +01:00
transferaccounter
operations: add method to real time account server side copy
2026-03-03 14:01:11 +00:00
transform
Version v1.74.0
2026-05-01 15:56:56 +01:00
version
Fix lint issues reported by staticcheck
2022-06-13 21:13:50 +02:00