Re: [PR] HTTPCORE-756: replace CR, LF, NULL in header values with SP per RFC 9110 section 5.5 [httpcomponents-core]

2023-10-02 Thread via GitHub
ok2c commented on code in PR #437: URL: https://github.com/apache/httpcomponents-core/pull/437#discussion_r1342526096 ## httpcore5/src/main/java/org/apache/hc/core5/http/message/BufferedHeader.java: ## @@ -110,7 +113,27 @@ public String getName() { @Override public

Re: [PR] HTTPCORE-756: replace CR, LF, NULL in header values with SP per RFC 9110 section 5.5 [httpcomponents-core]

2023-10-02 Thread via GitHub
ok2c commented on code in PR #437: URL: https://github.com/apache/httpcomponents-core/pull/437#discussion_r1342526323 ## httpcore5/src/main/java/org/apache/hc/core5/http/message/BufferedHeader.java: ## @@ -110,7 +113,27 @@ public String getName() { @Override public

Re: [PR] HTTPCORE-756: replace CR, LF, NULL in header values with SP per RFC 9110 section 5.5 [httpcomponents-core]

2023-10-02 Thread via GitHub
ok2c merged PR #437: URL: https://github.com/apache/httpcomponents-core/pull/437 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: dev-unsubscr...@hc.apac

[jira] [Commented] (HTTPCORE-756) HttpCore HTTP Semantics conformance to RFC 9110

2023-10-02 Thread ASF subversion and git services (Jira)
[ https://issues.apache.org/jira/browse/HTTPCORE-756?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17771037#comment-17771037 ] ASF subversion and git services commented on HTTPCORE-756: -- Co

Re: [PR] Add security warning to TrustStrategy implementations documentation [httpcomponents-client]

2023-10-02 Thread via GitHub
ok2c commented on code in PR #490: URL: https://github.com/apache/httpcomponents-client/pull/490#discussion_r1342539092 ## httpclient5/src/main/java/org/apache/hc/client5/http/ssl/TrustAllStrategy.java: ## @@ -34,9 +34,15 @@ import org.apache.hc.core5.ssl.TrustStrategy; /**

Re: [PR] Add security warning to TrustStrategy implementations documentation [httpcomponents-client]

2023-10-02 Thread via GitHub
ok2c commented on PR #490: URL: https://github.com/apache/httpcomponents-client/pull/490#issuecomment-1742799336 @Marcono1234 I also propose `TrustSelfSignedStrategy` be deprecated in favor of `SSLContextBuilder`. The class is basically useless. -- This is an automated message from the A

Re: [PR] Add security warning to TrustStrategy documentation [httpcomponents-core]

2023-10-02 Thread via GitHub
ok2c commented on code in PR #438: URL: https://github.com/apache/httpcomponents-core/pull/438#discussion_r1342546547 ## httpcore5/src/main/java/org/apache/hc/core5/ssl/TrustStrategy.java: ## @@ -34,6 +34,19 @@ * configured in the actual SSL context. This interface can be use

Re: [PR] Add security warning to TrustStrategy documentation [httpcomponents-core]

2023-10-02 Thread via GitHub
ok2c commented on code in PR #438: URL: https://github.com/apache/httpcomponents-core/pull/438#discussion_r1342546547 ## httpcore5/src/main/java/org/apache/hc/core5/ssl/TrustStrategy.java: ## @@ -34,6 +34,19 @@ * configured in the actual SSL context. This interface can be use

[jira] [Resolved] (HTTPCLIENT-2302) Examples ClientCustomSSL and AsyncClientCustomSSL are misleading and insecure

2023-10-02 Thread Oleg Kalnichevski (Jira)
[ https://issues.apache.org/jira/browse/HTTPCLIENT-2302?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Oleg Kalnichevski resolved HTTPCLIENT-2302. --- Resolution: Information Provided > Examples ClientCustomSSL and AsyncCli

[jira] [Commented] (HTTPCLIENT-2302) Examples ClientCustomSSL and AsyncClientCustomSSL are misleading and insecure

2023-10-02 Thread Marcono1234 (Jira)
[ https://issues.apache.org/jira/browse/HTTPCLIENT-2302?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17771248#comment-17771248 ] Marcono1234 commented on HTTPCLIENT-2302: - {quote} Marcono1234 And then what

Re: [PR] Add security warning to TrustStrategy implementations documentation [httpcomponents-client]

2023-10-02 Thread via GitHub
Marcono1234 commented on code in PR #490: URL: https://github.com/apache/httpcomponents-client/pull/490#discussion_r1343057798 ## httpclient5/src/main/java/org/apache/hc/client5/http/ssl/TrustAllStrategy.java: ## @@ -34,9 +34,15 @@ import org.apache.hc.core5.ssl.TrustStrategy;

Re: [PR] Add security warning to TrustStrategy implementations documentation [httpcomponents-client]

2023-10-02 Thread via GitHub
Marcono1234 commented on PR #490: URL: https://github.com/apache/httpcomponents-client/pull/490#issuecomment-1743608258 > I also propose TrustSelfSignedStrategy be deprecated in favor of SSLContextBuilder. The class is basically useless. Should I include this in this PR or create a s

Re: [PR] Add security warning to TrustStrategy documentation [httpcomponents-core]

2023-10-02 Thread via GitHub
Marcono1234 commented on code in PR #438: URL: https://github.com/apache/httpcomponents-core/pull/438#discussion_r1343067206 ## httpcore5/src/main/java/org/apache/hc/core5/ssl/TrustStrategy.java: ## @@ -34,6 +34,19 @@ * configured in the actual SSL context. This interface can

[jira] [Commented] (HTTPCLIENT-2302) Examples ClientCustomSSL and AsyncClientCustomSSL are misleading and insecure

2023-10-02 Thread Oleg Kalnichevski (Jira)
[ https://issues.apache.org/jira/browse/HTTPCLIENT-2302?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17771260#comment-17771260 ] Oleg Kalnichevski commented on HTTPCLIENT-2302: --- [~Marcono1234] I do n

Re: [PR] Add security warning to TrustStrategy implementations documentation [httpcomponents-client]

2023-10-02 Thread via GitHub
ok2c commented on code in PR #490: URL: https://github.com/apache/httpcomponents-client/pull/490#discussion_r1343119220 ## httpclient5/src/main/java/org/apache/hc/client5/http/ssl/TrustAllStrategy.java: ## @@ -34,9 +34,15 @@ import org.apache.hc.core5.ssl.TrustStrategy; /**

Re: [PR] Add security warning to TrustStrategy implementations documentation [httpcomponents-client]

2023-10-02 Thread via GitHub
ok2c commented on PR #490: URL: https://github.com/apache/httpcomponents-client/pull/490#issuecomment-1743706149 @Marcono1234 Just deprecate `TrustSelfSignedStrategy`in the same PR. I would not bother with a backport of the changes to 4.x but I will merge them if you raise a PR for the

Re: [PR] Add security warning to TrustStrategy documentation [httpcomponents-core]

2023-10-02 Thread via GitHub
ok2c commented on code in PR #438: URL: https://github.com/apache/httpcomponents-core/pull/438#discussion_r1343130372 ## httpcore5/src/main/java/org/apache/hc/core5/ssl/TrustStrategy.java: ## @@ -34,6 +34,19 @@ * configured in the actual SSL context. This interface can be use

Re: [PR] Add security warning to TrustStrategy documentation [httpcomponents-core]

2023-10-02 Thread via GitHub
ok2c commented on code in PR #438: URL: https://github.com/apache/httpcomponents-core/pull/438#discussion_r1343130372 ## httpcore5/src/main/java/org/apache/hc/core5/ssl/TrustStrategy.java: ## @@ -34,6 +34,19 @@ * configured in the actual SSL context. This interface can be use

Re: [PR] Add security warning to TrustStrategy documentation [httpcomponents-core]

2023-10-02 Thread via GitHub
ok2c commented on code in PR #438: URL: https://github.com/apache/httpcomponents-core/pull/438#discussion_r1343130372 ## httpcore5/src/main/java/org/apache/hc/core5/ssl/TrustStrategy.java: ## @@ -34,6 +34,19 @@ * configured in the actual SSL context. This interface can be use