fluent / fluent/fluentd

Replace http_parser.rb with llhttp or other equivalents

Open
#3,437 0 comments 0 reactions 1 assignee Claimed by @ashie View on GitHub
enhancement
Dominant language
Ruby
Stars
13.6k
Forks
1.4k
Avg merge
1d 3h
Merged PRs (30d)
20

Description

**Describe the bug**
Fluentd depends on [http_parser.rb](https://rubygems.org/gems/http_parser.rb) but it's not maintained and not released new version since December 11, 2013.
In this gem, vulnerability is often detected mistakenly by several security tools because it includes a garbage Gemfile.lock. e.g.) #3409 #3374

I'm troublesome to support such issue, so that I've gotten ownership of http_parser.rb and I'll release a new gem which fixes this issue. Although such false positive will be suppressed by it, we should consider replacing http_parser.rb with other equivalents such as [llhttp](https://github.com/nodejs/llhttp) because dependent [http-parser](https://github.com/nodejs/http-parser) is already dead too.

**To Reproduce**
See https://github.com/nodejs/http-parser
> http-parser is not actively maintained. New projects and projects looking to migrate should consider llhttp.

**Expected behavior**
Dependent libraries should be well maintained.

**Your Environment**
N/A

**Your Configuration**
N/A

**Your Error Log**
N/A

**Additional context**
N/A

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.