Re: Host header validation

2017-04-13 Thread Mark Thomas
On 10/04/17 07:42, Katya Todorova wrote: > On Wed, Apr 5, 2017 at 3:57 PM, Mark Thomas wrote: > >> On 05/04/2017 07:50, Katya Todorova wrote: >> >>> Applied. Many thanks. If you'd like to work on this further then can I suggest you take a look at Konstantin's comments: >>

Re: Host header validation

2017-04-09 Thread Katya Todorova
On Wed, Apr 5, 2017 at 3:57 PM, Mark Thomas wrote: > On 05/04/2017 07:50, Katya Todorova wrote: > >> >>> Applied. Many thanks. >>> >>> If you'd like to work on this further then can I suggest you take a look >>> at Konstantin's comments: >>> >>> http://markmail.org/message/vp5voob7elspflax >>> >>

Re: Host header validation

2017-04-05 Thread Mark Thomas
On 05/04/2017 07:50, Katya Todorova wrote: Applied. Many thanks. If you'd like to work on this further then can I suggest you take a look at Konstantin's comments: http://markmail.org/message/vp5voob7elspflax I looked at the comments and it seems there are things to be clarified before goin

Re: Host header validation

2017-04-04 Thread Katya Todorova
> > Applied. Many thanks. > > If you'd like to work on this further then can I suggest you take a look > at Konstantin's comments: > > http://markmail.org/message/vp5voob7elspflax I looked at the comments and it seems there are things to be clarified before going in this direction: - should we in

Re: Host header validation

2017-03-31 Thread Mark Thomas
On 31/03/17 14:41, Mark Thomas wrote: > On 31/03/17 09:43, Katya Todorova wrote: >> I've created a separate pull request for leading zeros issue since I think >> it requires additional discussion whether to be submitted or not. Although >> this fix honors the specification, it leads to different

Re: Host header validation

2017-03-31 Thread Mark Thomas
On 31/03/17 09:43, Katya Todorova wrote: >> You can either create a pull request on github or create a Bugzilla >> issue and attach a patch. > > >> Mark >> > > I've created a separate pull request for leading zeros issue since I think > it requires additional discussion whether to be submitted o

Re: Host header validation

2017-03-31 Thread Katya Todorova
> You can either create a pull request on github or create a Bugzilla > issue and attach a patch. > Mark > I've created a separate pull request for leading zeros issue since I think it requires additional discussion whether to be submitted or not. Although this fix honors the specification, it l

Re: Host header validation

2017-03-29 Thread Mark Thomas
On 29/03/17 15:16, Katya Todorova wrote: >> >> I recommend using the code coverage reports as a guide. >> >> https://ci.apache.org/projects/tomcat/tomcat9/coverage/ > > >> >> and add test cases if they increase code coverage. Hmm. It looks like >> there is some low hanging fruit in the parsing co

Re: Host header validation

2017-03-29 Thread Katya Todorova
> > I recommend using the code coverage reports as a guide. > > https://ci.apache.org/projects/tomcat/tomcat9/coverage/ > > and add test cases if they increase code coverage. Hmm. It looks like > there is some low hanging fruit in the parsing code to improve coverage. > > You can run the tests wi

Re: Host header validation

2017-03-29 Thread Mark Thomas
On 29/03/17 07:06, Katya Todorova wrote: > On Tue, Mar 28, 2017 at 5:45 PM, Mark Thomas wrote: > >> On 28/03/17 15:23, Katya Todorova wrote: >>> Hi, r1787662 adds Host header validation along with a fair number of unit >> tests. It includes a performance test which indicates - on my mac

Re: Host header validation

2017-03-28 Thread Katya Todorova
On Tue, Mar 28, 2017 at 5:45 PM, Mark Thomas wrote: > On 28/03/17 15:23, Katya Todorova wrote: > > Hi, > >> r1787662 adds Host header validation along with a fair number of unit > tests. > >> It includes a performance test which indicates - on my machine at least > >> - that the performance impac

Re: Host header validation

2017-03-28 Thread Katya Todorova
On Tue, Mar 28, 2017 at 5:45 PM, Mark Thomas wrote: > On 28/03/17 15:23, Katya Todorova wrote: > > Hi, > >> r1787662 adds Host header validation along with a fair number of unit > tests. > >> It includes a performance test which indicates - on my machine at least > >> - that the performance impac

Re: Host header validation

2017-03-28 Thread Mark Thomas
On 28/03/17 15:23, Katya Todorova wrote: > Hi, >> r1787662 adds Host header validation along with a fair number of unit tests. >> It includes a performance test which indicates - on my machine at least >> - that the performance impact is in the noise. I'd like to see better >> performance for full

Re: Host header validation

2017-03-28 Thread Katya Todorova
Hi, > r1787662 adds Host header validation along with a fair number of unit tests. > It includes a performance test which indicates - on my machine at least > - that the performance impact is in the noise. I'd like to see better > performance for full IPv6 addresses but the current code looks to be

Re: Host header validation

2017-03-24 Thread Mark Thomas
On 22/03/17 14:13, Konstantin Kolinko wrote: > 2017-03-21 18:01 GMT+03:00 Mark Thomas : >> On 21 March 2017 14:14:19 GMT+00:00, Christopher Schultz >> wrote: >>> >>> How about an option to disable the validity-checking, in case someone >>> in the field finds a case they need to support, or if the

Re: Host header validation

2017-03-22 Thread Konstantin Kolinko
2017-03-21 18:01 GMT+03:00 Mark Thomas : > On 21 March 2017 14:14:19 GMT+00:00, Christopher Schultz > wrote: >> >>How about an option to disable the validity-checking, in case someone >>in the field finds a case they need to support, or if they don't care >>about hostname-checking and want their

Re: Host header validation

2017-03-21 Thread Mark Thomas
On 21 March 2017 14:14:19 GMT+00:00, Christopher Schultz wrote: >Mark, > >On 3/19/17 4:55 PM, Mark Thomas wrote: >> Hi, >> >> r1787662 adds Host header validation along with a fair number of >> unit tests. >> >> It includes a performance test which indicates - on my machine at >> least - that t

Re: Host header validation

2017-03-21 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 3/19/17 4:55 PM, Mark Thomas wrote: > Hi, > > r1787662 adds Host header validation along with a fair number of > unit tests. > > It includes a performance test which indicates - on my machine at > least - that the performance impact is in