illy [Shrimple-mode] :protomoji_orange_flag_lesbian: (@illyBytes)

1mo

i kinda wonder if anville should reject http requests that have multiple request headers with the exact same nyame

is there exactly a use-case for that, is there anything i'm missing? i know it's a part of the standard, but to me it feels like it's very likely to be a possible exploit attempt

3

2

0

sugar :4 🏳️‍🌈 @sugar@snug.moe

1mo

well, may as well test that on production

codeberg.org/sugar700/anville/commit/79413ab417d7e18878fd4b4fbc98ee851e73efe8

will see if anyone hits this code path

1

0

1

0

sugar :4 🏳️‍🌈 @sugar@snug.moe

1mo

and, i already am seeing a problem, akkoma is sending two accept headers with the values application/ld+json; profile="https://www.w3.org/ns/activitystreams" and application/activity+json

hm,,, i probably could special-case accept here, and automatically join multiple accept values with ,

1

0

1

0

sugar :4 🏳️‍🌈 @sugar@snug.moe

1mo

codeberg.org/sugar700/anville/commit/5449fc63e98f8d9374889ec6e29fb02e4c9b3d06

1

0

1

0

sugar :4 🏳️‍🌈 @sugar@snug.moe

1mo

got a request from a bot that tried sending both connection: keep-alive and connection: close

sure, may as well leave connection open and closed at the same time

1

2

1

2

1

illy [Shrimple-mode]

@illyBytes@shrimp.imsofucking.gay

1mo

@sugar quantum http

1

0

1