ooni / probe-cli / 41580808582

71%

Build Type

push

github

Committed by web-flow

Commit Message

Brotli and utls dependency updates for probe-cli (#1862)

## Checklist

- [X] I have read the [contribution
guidelines](https://github.com/ooni/probe-cli/blob/master/CONTRIBUTING.md)
- [ ] reference issue for this pull request: <!-- add URL here -->
- [ ] if you changed anything related to how experiments work and you
need to reflect these changes in the ooni/spec repository, please link
to the related ooni/spec pull request: <!-- add URL here -->
- [ ] if you changed code inside an experiment, make sure you bump its
version number

<!-- Reminder: Location of the issue tracker:
https://github.com/ooni/probe -->

## Description

After privately reporting on Friday some security-relevant dependency
updates for ooni/probe-cli, I've determined them to be low severity on
the Go language.

1. Dependency yawning/utls was last updated by the author on May 11,
2021.

aagbsn did a quality job on that aspect, so I decided to use it as a
basis for my changes.

chore(netxlite): use refraction-networking/utls instead of yawning/utls:
https://github.com/ooni/probe-cli/commit/<a class=hub.com/ooni/probe-cli/commit/c4fd3068dc955ff772e8b9a9b2ce2fa8576cb426">c4fd3068d

Old versions of utls have security advisories:
https://github.com/refraction-networking/utls/security

2. I've prepared a commit (based on
c4fd3068dc955ff772e8b9a9b2ce2fa8576cb426) that updates:
- [github.com/andybalholm/brotli](http://github.com/andybalholm/brotli)
v1.1.1 to v1.2.7
- [github.com/klauspost/compress](http://github.com/klauspost/compress)
v1.19.1 to v1.20.3

The Brotli update includes an important upstream security fix:

https://github.com/andybalholm/brotli/commit/33c2a9884

This corresponds to the fix integrated into wider work-in-progress
ooni/probe-cli at:
https://github.com/ooni/probe-cli/commit/cefd4d70c


https://www.sweet.security/blog/http2shell-sweet-security-confirms-brotli-vulnerability-also-affects-native-go-implementations

My two cents. Thank you.

---------

Co-a... (continued)

Coverage Stats

1 of 1 new or added line in 1 file covered. (100.0%)

2 existing lines in 1 file now uncovered.

23765 of 33255 relevant lines covered (71.46%)

38.69 hits per line