Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package qt6-httpserver for openSUSE:Factory checked in at 2026-08-21 16:50:46 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/qt6-httpserver (Old) and /work/SRC/openSUSE:Factory/.qt6-httpserver.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "qt6-httpserver" Fri Aug 21 16:50:46 2026 rev:29 rq:1372242 version:6.11.2 Changes: -------- --- /work/SRC/openSUSE:Factory/qt6-httpserver/qt6-httpserver.changes 2026-05-28 17:25:27.924058725 +0200 +++ /work/SRC/openSUSE:Factory/.qt6-httpserver.new.1258/qt6-httpserver.changes 2026-08-21 16:51:41.607497879 +0200 @@ -1,0 +2,6 @@ +Tue Aug 18 11:48:40 UTC 2026 - Christophe Marin <[email protected]> + +- Update to 6.11.2 + https://www.qt.io/blog/qt-6.11.2-released + +------------------------------------------------------------------- Old: ---- qthttpserver-everywhere-src-6.11.1.tar.xz New: ---- qthttpserver-everywhere-src-6.11.2.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ qt6-httpserver.spec ++++++ --- /var/tmp/diff_new_pack.Ephtgt/_old 2026-08-21 16:51:42.461528247 +0200 +++ /var/tmp/diff_new_pack.Ephtgt/_new 2026-08-21 16:51:42.463528318 +0200 @@ -16,7 +16,7 @@ # -%define real_version 6.11.1 +%define real_version 6.11.2 %define short_version 6.11 %define tar_name qthttpserver-everywhere-src %define tar_suffix %{nil} @@ -27,7 +27,7 @@ %endif # Name: qt6-httpserver%{?pkg_suffix} -Version: 6.11.1 +Version: 6.11.2 Release: 0 Summary: Qt HTTP Server License: GPL-3.0-only ++++++ qthttpserver-everywhere-src-6.11.1.tar.xz -> qthttpserver-everywhere-src-6.11.2.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/qthttpserver-everywhere-src-6.11.1/.cmake.conf new/qthttpserver-everywhere-src-6.11.2/.cmake.conf --- old/qthttpserver-everywhere-src-6.11.1/.cmake.conf 2026-05-08 04:06:39.000000000 +0200 +++ new/qthttpserver-everywhere-src-6.11.2/.cmake.conf 2026-08-12 04:49:05.000000000 +0200 @@ -1,8 +1,9 @@ -set(QT_REPO_MODULE_VERSION "6.11.1") +set(QT_REPO_MODULE_VERSION "6.11.2") set(QT_REPO_MODULE_PRERELEASE_VERSION_SEGMENT "alpha1") set(QT_EXTRA_INTERNAL_TARGET_DEFINES "QT_ENABLE_STRICT_MODE_UP_TO=QT_VERSION_CHECK(6,11,0)" # not yet in strict mode: "QT_LEAN_HEADERS=2" "QT_NO_QPAIR=1" + "QT_NO_SINGLE_ARGUMENT_QHASH_OVERLOAD=1" ) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/qthttpserver-everywhere-src-6.11.1/.tag new/qthttpserver-everywhere-src-6.11.2/.tag --- old/qthttpserver-everywhere-src-6.11.1/.tag 2026-05-08 04:06:39.000000000 +0200 +++ new/qthttpserver-everywhere-src-6.11.2/.tag 2026-08-12 04:49:05.000000000 +0200 @@ -1 +1 @@ -c80d6aa0d09e937ffd1380148f73918d4f9a92b6 +86edbe897f1e7097cff1ae392e455f3055b84e68 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/qthttpserver-everywhere-src-6.11.1/dependencies.yaml new/qthttpserver-everywhere-src-6.11.2/dependencies.yaml --- old/qthttpserver-everywhere-src-6.11.1/dependencies.yaml 2026-05-08 04:06:39.000000000 +0200 +++ new/qthttpserver-everywhere-src-6.11.2/dependencies.yaml 2026-08-12 04:49:05.000000000 +0200 @@ -1,7 +1,7 @@ dependencies: ../qtbase: - ref: 59c81a3c2247b821b9b84b4eb8d939b77e07e276 + ref: ef55f427f2c8b410d34f8a7681020a3000cf6866 required: true ../qtwebsockets: - ref: 451920600d7f0b8a4b458bba56a2dd303e587026 + ref: 3eab06de7076a83514e98c2403baa433d137b013 required: false diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/qthttpserver-everywhere-src-6.11.1/doc/index.qdoc new/qthttpserver-everywhere-src-6.11.2/doc/index.qdoc --- old/qthttpserver-everywhere-src-6.11.1/doc/index.qdoc 2026-05-08 04:06:39.000000000 +0200 +++ new/qthttpserver-everywhere-src-6.11.2/doc/index.qdoc 2026-08-12 04:49:05.000000000 +0200 @@ -7,10 +7,13 @@ \title Qt HTTP Server \brief Provides a lightweight server implementing the HTTP protocol. - Qt HTTP Server supports building HTTP server functionality into an application. - Common use cases are exposing the application's functionality through - REST APIs, or making devices in a trusted environment configurable also via HTTP. - The limitations are described in \l{Limitations and Security}. + Qt HTTP Server supports building HTTP server functionality into an + application. The main use case is exposing the application's functionality + through REST APIs, or making devices in a trusted environment also + configurable over HTTP. A trusted environment also means that the Qt HTTP + Server must not be directly exposed to the internet nor used to provide + functionality of a general-purpose web server for end users. For more + details, see \l{Limitations and Security}. \section1 Overview @@ -63,6 +66,8 @@ active TLS backend is needed for HTTP/2 support. To check if a backend supports this, use \l{QSslSocket::isFeatureSupported}. + See \l{Qt HTTP Server Security Considerations}. + \section1 Using the Module Using a Qt module requires linking against the module library, either @@ -98,6 +103,7 @@ \section1 Reference \list + \li \l{Qt HTTP Server Security Considerations} \li \l{Qt HTTP Server Logging} \li \l{Qt HTTP Server C++ Classes}{C++ Classes} \endlist diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/qthttpserver-everywhere-src-6.11.1/doc/qthttpserver-security.qdoc new/qthttpserver-everywhere-src-6.11.2/doc/qthttpserver-security.qdoc --- old/qthttpserver-everywhere-src-6.11.1/doc/qthttpserver-security.qdoc 1970-01-01 01:00:00.000000000 +0100 +++ new/qthttpserver-everywhere-src-6.11.2/doc/qthttpserver-security.qdoc 2026-08-12 04:49:05.000000000 +0200 @@ -0,0 +1,122 @@ +// Copyright (C) 2026 The Qt Company Ltd. +// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR GFDL-1.3-no-invariants-only + +/*! + \page qthttpserver-security.html + \title Qt HTTP Server Security Considerations + \ingroup security + \brief Provides the recommended security settings for Qt HTTP Server. + + \section1 Overview + + Qt HTTP Server provides several configuration settings to help protect + an application against misuse scenarios such as malformed requests or + unauthorized access. Qt 6.10 added several security configuration + settings. This page summarizes recommended configurations and explains + when and how to use them. + + \warning Do not expose Qt HTTP Server directly to the internet. Qt HTTP + Server is not hardened against network-based attacks. + + \section1 Network setups and configurations + + Here are different ways to set up a network with a Qt HTTP Server. + + \section2 No internet access + + Ideally there should be no access to the internet at all. This is the + safest setup, but you often need internet access. If Qt HTTP Server + is bound to localhost or to a \l{QLocalServer}, it does not accept + connections from the internet. + + \section2 Binding to QSslServer on the internet + + It is possible, but not supported to bind the Qt HTTP Server to a + \l{QSslServer} that is bound to a network interface that is reachable from + the internet. Despite all the options in \l{QHttpServerConfiguration}, this + setup is not supported because Qt HTTP Server is not sufficiently + hardened. + + \section1 Application setup + + If using a thread pool, make sure it is not so large that the server + cannot handle simultaneous, resource-intensive incoming requests. + Though the \l{QHttpServer::}{route()} call makes parsing from the URL + in the HTTP requests easy, it is the developer's responsibility to + handle input validation. + + \section1 Qt HTTP Server security configuration + + Configure Qt HTTP Server through the \l{QHttpServerConfiguration} class. + Adjust the limits based on your platform's capabilities and network setup. + + \section2 Rate limits + + \list + \li Configure the maximum number of requests per second + per client IP using + \l{QHttpServerConfiguration::}{setRateLimitPerSecond()}. + By default, there is no rate limit. When the limit is exceeded, + the server responds with status code 429 (Too Many Requests). + \endlist + + \section2 Connection limits + + \list + \li Configure the maximum idle time for keep-alive connections + using \l{QHttpServerConfiguration::}{setKeepAliveTimeout()}. + By default, the timeout is 15 seconds. + \endlist + + \section2 Allowlisting and denylisting + + \list + \li Configure the list of client subnets that are allowed to access the + server using \l{QHttpServerConfiguration::}{setWhitelist()}. + By default, the allowlist is empty, and all clients are allowed. + If the allowlist is not empty, only addresses in this list + are accepted. + The allowlist is checked before the denylist. + + \li Configure the denied client subnets using + \l{QHttpServerConfiguration::}{setBlacklist()}. + The denylist is only applied when the allowlist is empty. + By default, the denylist is empty. + \endlist + + \section2 Request size limits + + \list + \li Configure the maximum URL size using + \l{QHttpServerConfiguration::}{setMaximumUrlSize()}. + If the limit is exceeded, the server responds with HTTP status + code 414 (Request-URI Too Long). + The default maximum URL size is 64 KiB. + + \li Configure the maximum total size of all HTTP request headers + using \l{QHttpServerConfiguration::}{setMaximumTotalHeaderSize()}. + If the limit is exceeded, the server responds with HTTP status code + 431 (Request Header Fields Too Large). + The default total header size is 64 KiB. + + \li Configure the maximum size of a single HTTP header field + using \l{QHttpServerConfiguration::}{setMaximumHeaderFieldSize()}. + If the limit is exceeded, the server responds with HTTP status code + 431 (Request Header Fields Too Large). + The default maximum header field size is 48 KiB. + + \li Configure the maximum number of HTTP header fields per request + using \l{QHttpServerConfiguration::}{setMaximumHeaderFieldCount()}. + If the limit is exceeded, the server responds with HTTP status code + 431 (Request Header Fields Too Large). + The default maximum header field count is 128. + + \li Configure the maximum request body size using + \l{QHttpServerConfiguration::}{setMaximumBodySize()}. + If the limit is exceeded, the server responds with HTTP status code + 413 (Content Too Large). + The default maximum body size is 32 MiB. + \endlist + + \note Always use the latest security updates for Qt and all dependent libraries. +*/ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/qthttpserver-everywhere-src-6.11.1/src/httpserver/qhttpserverconfiguration.cpp new/qthttpserver-everywhere-src-6.11.2/src/httpserver/qhttpserverconfiguration.cpp --- old/qthttpserver-everywhere-src-6.11.1/src/httpserver/qhttpserverconfiguration.cpp 2026-05-08 04:06:39.000000000 +0200 +++ new/qthttpserver-everywhere-src-6.11.2/src/httpserver/qhttpserverconfiguration.cpp 2026-08-12 04:49:05.000000000 +0200 @@ -46,7 +46,15 @@ Such a configuration has the following values: \list - \li Rate limit is disabled + \li Rate limit is disabled. + \li Keep-alive timeout is set to 15 seconds. + \li Whitelist is empty. + \li Blacklist is empty. + \li Maximum Url size is 64 KiB. + \li Maximum total header size is 64 KiB. + \li Maximum header field size is 48 KiB. + \li Maximum number of header fields is 128. + \li Maximum body size is 32 MiB. \endlist */ QHttpServerConfiguration::QHttpServerConfiguration() @@ -88,6 +96,11 @@ If the limit is exceeded, QHttpServer will respond with QHttpServerResponder::StatusCode::TooManyRequests. + This limit is applied separately to each client IP address. + A value of 0 disables rate limiting. + + By default, rate limiting is disabled. + \sa rateLimitPerSecond(), QHttpServerResponder::StatusCode */ void QHttpServerConfiguration::setRateLimitPerSecond(quint32 maxRequests) @@ -100,6 +113,9 @@ Returns maximum number of incoming requests per second per IP accepted by the server. + This limit is applied separately to each client IP address. + Returns 0 if rate limiting is disabled. + \sa setRateLimitPerSecond() */ quint32 QHttpServerConfiguration::rateLimitPerSecond() const @@ -114,6 +130,7 @@ The keep-alive timeout determines how long an idle connection is kept open before being closed. + By default, the timeout is set to 15 seconds. \sa keepAliveTimeout() @@ -128,6 +145,8 @@ \since 6.10 Returns the keep-alive timeout used by QHttpServer. + This is the amount of time an idle connections may remain open + before it is timed out. \sa setKeepAliveTimeout() */ @@ -154,6 +173,8 @@ To allow only a specific IP address, use a prefix length of 32 for IPv4 (e.g., \c "192.168.1.100/32") or 128 for IPv6 (e.g., \c "2001:db8::1/128"). + By default, the whitelist is empty. + \sa whitelist(), setBlacklist(), QHostAddress::parseSubnet() */ void QHttpServerConfiguration::setWhitelist(QSpan<const std::pair<QHostAddress, int>> subnetList) @@ -167,6 +188,11 @@ Returns the whitelist of subnets allowed by QHttpServer. + When the whitelist is not empty, only addresses in the returned subnets + are allowed. The whitelist takes priority over blacklist. + + By default, the whitelist is empty. + \sa setWhitelist() */ QSpan<const std::pair<QHostAddress, int>> QHttpServerConfiguration::whitelist() const @@ -182,6 +208,8 @@ IP addresses in this list will be denied access by QHttpServer. The blacklist is active only when the whitelist is empty. + By default, the blacklist is empty. + \sa blacklist(), setWhitelist(), QHostAddress::parseSubnet() */ void QHttpServerConfiguration::setBlacklist(QSpan<const std::pair<QHostAddress, int>> subnetList) @@ -205,10 +233,11 @@ /*! \since 6.11 - Sets \a maxSize as the maximum size of the URL + Sets \a maxSize as the maximum size of the request URL that the server will accept. If the limit is exceeded, QHttpServer will respond with status 414 Request-URI Too Long. If \a maxSize is -1 there is no limit. + The default is 64 KiB. \sa maximumUrlSize(), QHttpServerResponder::StatusCode @@ -222,7 +251,7 @@ /*! \since 6.11 - Returns maximum size of the URL accepted by the + Returns the maximum size of the URL accepted by the server. \sa setMaximumUrlSize() @@ -235,10 +264,12 @@ /*! \since 6.11 - Sets \a maxSize as the maximum total size of the headers - that the server will accept. If the limit is exceeded, - QHttpServer will respond with status 431 Request Header - Fields Too Large. If \a maxSize is -1 there is no limit. + Sets \a maxSize as the maximum total size of the header fields + that the server will accept in a request. If the limit + is exceeded, QHttpServer will respond with + status 431 Request Header Fields Too Large. + If \a maxSize is -1 there is no limit. + The default is 64 KiB. \sa maximumTotalHeaderSize(), QHttpServerResponder::StatusCode @@ -252,7 +283,7 @@ /*! \since 6.11 - Returns maximum size of the total incoming headers accepted + Returns the maximum size of the total incoming headers accepted by the server. \sa setMaximumTotalHeaderSize() @@ -265,10 +296,12 @@ /*! \since 6.11 - Sets \a maxSize as the maximum size of a single header - that the server will accept. If the limit is exceeded, - QHttpServer will respond with status 431 Request Header - Fields Too Large. If \a maxSize is -1 there is no limit. + Sets \a maxSize as the maximum size of any single header + field that the server will accept in a request. If the limit + is exceeded, QHttpServer will respond with status + 431 Request Header Fields Too Large. If \a maxSize is -1 + there is no limit. + The default is 48 KiB. \sa maximumHeaderFieldSize(), QHttpServerResponder::StatusCode @@ -282,7 +315,7 @@ /*! \since 6.11 - Returns maximum size of the incoming headers accepted + Returns the maximum size of each incoming header field accepted by the server. \sa setMaximumHeaderFieldSize() @@ -296,9 +329,11 @@ \since 6.11 Sets \a maxSize as the maximum number of header fields - that the server will accept. If the limit is exceeded, - QHttpServer will respond with status 431 Request Header - Fields Too Large. If \a maxSize is -1 there is no limit. + that the server will accept in a request. + If the limit is exceeded, QHttpServer will respond with + status 431 Request Header Fields Too Large. + If \a maxSize is -1 there is no limit. + The default is 128. \sa maximumHeaderFieldCount(), QHttpServerResponder::StatusCode @@ -312,7 +347,7 @@ /*! \since 6.11 - Returns maximum number of incoming header fields accepted + Returns the maximum number of incoming header fields accepted by the server. \sa setMaximumHeaderFieldCount() @@ -325,10 +360,12 @@ /*! \since 6.11 - Sets \a maxSize as the maximum size of the body + Sets \a maxSize as the maximum size of the request body that the server will accept. If the limit is exceeded, QHttpServer will respond with status 413 Content Too Large. - If \a maxSize is -1 there is no limit. The default is 32 MiB. + If \a maxSize is -1 there is no limit. + + The default is 32 MiB. \sa maximumBodySize(), QHttpServerResponder::StatusCode */ @@ -341,7 +378,7 @@ /*! \since 6.11 - Returns maximum size of the incoming body accepted + Returns the maximum size of the incoming body accepted by the server. \sa setMaximumBodySize() diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/qthttpserver-everywhere-src-6.11.1/src/httpserver/qhttpserverhttp2protocolhandler.cpp new/qthttpserver-everywhere-src-6.11.2/src/httpserver/qhttpserverhttp2protocolhandler.cpp --- old/qthttpserver-everywhere-src-6.11.1/src/httpserver/qhttpserverhttp2protocolhandler.cpp 2026-05-08 04:06:39.000000000 +0200 +++ new/qthttpserver-everywhere-src-6.11.2/src/httpserver/qhttpserverhttp2protocolhandler.cpp 2026-08-12 04:49:05.000000000 +0200 @@ -24,7 +24,7 @@ { for (qsizetype i = 0; i < headers.size(); ++i) { const auto name = headers.nameAt(i); - fields.push_back(HPack::HeaderField(QByteArray(name.data(), name.size()), + fields.push_back(HPack::HeaderField(QByteArray(name.data(), name.size()).toLower(), headers.valueAt(i).toByteArray())); } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/qthttpserver-everywhere-src-6.11.1/tests/auto/qhttpserver/tst_qhttpserver.cpp new/qthttpserver-everywhere-src-6.11.2/tests/auto/qhttpserver/tst_qhttpserver.cpp --- old/qthttpserver-everywhere-src-6.11.1/tests/auto/qhttpserver/tst_qhttpserver.cpp 2026-05-08 04:06:39.000000000 +0200 +++ new/qthttpserver-everywhere-src-6.11.2/tests/auto/qhttpserver/tst_qhttpserver.cpp 2026-08-12 04:49:05.000000000 +0200 @@ -1949,9 +1949,15 @@ "User-Agent: curl/7.88.1\r\n" "Accept: */*\r\n\r\n"); - const QString expectedString = - u"HTTP/1.1 200 OK\r\ncontent-type: text/html\r\ncontent-length: 8\r\n"_s - u"connection: keep-alive\r\nkeep-alive: timeout=%1\r\n\r\ntest msg"_s; + auto headerName = [](QHttpHeaders::WellKnownHeader header) { + return QString::fromLatin1(QHttpHeaders::wellKnownHeaderName(header)); + }; + const QString expectedString = u"HTTP/1.1 200 OK\r\n%1: text/html\r\n%2: 8\r\n" + u"%3: keep-alive\r\n%4: timeout=%5\r\n\r\ntest msg"_s + .arg(headerName(QHttpHeaders::WellKnownHeader::ContentType), + headerName(QHttpHeaders::WellKnownHeader::ContentLength), + headerName(QHttpHeaders::WellKnownHeader::Connection), + headerName(QHttpHeaders::WellKnownHeader::KeepAlive)); const QByteArray expectedResult = expectedString.arg(timeout).toUtf8(); // We need to call process events a couple of times for the write/read to go through
