The Perl Toolchain Summit needs more sponsors. If your company depends on Perl, please support this very important event.
SULLR / App-DubiousHTTP-0.038 / Changes 
2023/09/18 0.038
- added copyright information which also include the terms of using the
  code by others

2021/02/28 0.037
- test for TE chunked with data after each chunk and not covered by length

2021/02/26 0.036
- changed bugtracker in Makefile.PL to github, away from obsolete rt.cpan.org

2019/03/09 0.035
- encode EICAR test virus so that stupid AV don't treat the distribution as
  malicious

2017/06/09 0.034
- support custom payloads instead of EICAR, see --help for how to use
- fixed submission
- added more tests, see git log for details

2016/06/20 0.033
- If the firewall supports it use eicar.zip for tests because this might
  trigger different behavior (binary, ZIP instead of text). If this gets
  successfully blocked retry with eicar.txt though.
- download names are now generic instead of eicar.txt and novirus.txt so
  that one could not just block based on this name
- detect if firewall/AV matches eicar+junk or junk+eicar which is not
  allowed according to EICAR usage requirements
- mark some tests as COMMON_INVALID to show that these are invalid but still
  commonly used in practive. Issue a warning if harmless content of this
  type gets blocked.
- some small tests added as variations of existing. These should probably not
  cause any problems but are used to detect blocking of invalid responses
  which are nevertheless commonly seen in practice.

2016/04/20 0.032
- fixed debug function in Javascript which caused the final submission to fail

2016/04/20 0.031
- Each tests now has a fixed ID which will not change over the development of
  the program, i.e. if tests gets added, deleted.... This ID can also be used
  directly, i.e. http://host/161/eicar.txt
- More tests:
  - hide data in gzip FEXTRA, made possible by using
    https://bugzilla.mozilla.org/show_bug.cgi?id=1244535
  - make use of too tolerant deflate/zlib handling in Chrome, Safari and FF.
    See commit 54ec8a6b8ce for details
  - FF uses strtoul to parsechunk size which accepts various prefixes and also
    signed data
  - some more status lines - chrome accepts almost anything
  - use ICY instead of HTTP/1.0 (FF only)
  - playing with 1xx preliminary response followed by real
  - Chrome accepts data partially compressed with gzip, rest uncompressed
  - Variations of HTTP version together with chunked and gzip
  - various kinds of white spaces, junk before header...

2016/01/03 0.030
- Extend pcap mode to write single file and to filter based on reports
    - Extend pcap export mode: all streams into one file, filter...
    - new test for chunking with junk at the end, but content-length with
      the size of the good content. Edge will ignore the junk
- tool bin/test-sanitizing.pl to look how good a proxy will sanitize the traffic
  against strange requests typically understood by browsers but not by
  firewalls, /manifest/ URL to just get a listing of possible tests as plain
  text
- More tests:
  - combining chunked and gzip
  - tests with brotli (Firefox 44, https)
  - combine gzip header with RFC1950 (zlib) instead of RC1951 (deflate)
  - HTTP header containing TE chunked without a status line
  - chunked body:
    - chunking with junk and content-length limited to good data
    - Various browsers accept data after the chunk size
    - Especially Firefox accepts lots of data before the chunk size, even "\r\n\r\n"
    - Various browsers accept junk at the end, like "0\r\nfoobar\r\n"
  - status codes:
    - Variations on 204: 0204, 2040, 204 with chunked encoding. IE and Edge
      continue to accept 204 with body. 2040 is usually accepted but download
      not necessarily works.
    - Code 299: usually treated the same as 200
  - Content-length:
    - Chrome/Opera accept "," before length
    - all browsers accept "," after length
    - most browser accept anything after length, even something like "68A","68.9"...
  - tricky ends of HTTP header:
     - \n\r\r\n - Safari, IE, Edge
     - \n\r\r\n\r\n - others
     - IE and Edge accept "\n<space>\n" or "\n\t\n"
  - line folding after key and before colon, i.e. Transfer-Encoding\n\t:chunked
    This will be accepted by Safari.
  - broken "white-space" and line folding:
    Chrome treats \n\000chunked as proper line folding, while the others don't
  - characters before and after the field or the colon
    - While Safari accepts anything before and after "chunked" (tested in
      Chunked.pm) it only accepts some characters before/after gzip and deflate.
      Among these are \v,\f,";" and \240 (latin1 non-breaking space)
    - FF, Chrome accept "," before and after chunked|gzip|deflate
  - \000 is nearly everywhere in the header ignored by Chrome (inside, before
    and after key and value...)
  - broken status lines
    - "HTTP/1.1foobar" (no status code etc) gets accepted by Chrome, Opera and
      Firefox.
  - various tests with invalid characters or UTF-8
  - extend compression tests with various kinds of sync between deflated parts

2015/11/12 0.029
- bulk testing of iframe tags with HTML inside
2015/11/08 0.028
- bulk testing of behavior regarding Javascript and Image loading (instead
  of only XHR)
2015/10/31 0.027
- way more tests of broken responses
- add tests for gzip compression flags and features
- add support for lzma compression, supported by at least Opera
- option --fast-feedback so that results  gets submitted in parts once they grow to big
- new script bin/normalize-logs.pl to normalize log files
2015/10/01 0.026
- add optional SSL and IPv6 support
- add more tests and fixed some 
- add more detailed output
2015/09/14 0.025
- some more tests
- better description for some tests
- enforce download via download attribute for eicar.txt etc
- according to RFC2616 a content-encoding header with 'identity' should not
  be used, moved to UNCOMMON_INVALID and added variations with double
  encoding etc
- complain if the firewall blocks sane response without virus, because that
  might indicate that they employ a URL filter only or similar
- If one evasion failed re-check with novirus.txt if it failed because of the
  firewall or because the browser considered the response invalid. Also add
  these information to the summary for the user and tell the user again how to
  check for false positives and how EICAR looks like.
- give summary and offer a way to give feedback with product details
- log response header we got for initial innocent and test virus request
2015/09/04 0.024
- if in the automated evasion test the initial simple request to eicar.txt
  results in the expected failure add the error message to the results sent
  in /submit_results
- track different request headers, i.e order of fields etc to distinguish browsers 
  and changes done by proxies
- by default garble URLs so firewalls can not simply block all URLs with 
  eicar.txt inside, switch off with --no-garble-url. It will still accept
  ungarbled URLs but produce garbled ones.
- with http://host/broken/ALL/testid etc one will get the test line with
  image, script, html ... for only this test (i.e http://host/broken/ALL/302).
2015/08/21 0.023
- lots of beautification and documentation
- added tests for script include behavior too (which shows that Chrome is more
  strict when including scripts)
2015/08/05 0.022
- add some more tests
- offer to show src of response in auto-mode
- fix content-length header in Broken.pm
2015/07/29 0.021
- make sure we always send some kind of length (Content-length or chunked)
  because some firewalls don't scan content with unspecified length which
  would then distort test results
- some more tests and documentation fixes
2015/06/26 0.020
- yet more broken HTTP responses
- fix closing after response in some cases
- fix load limitation of server
2015/06/26 0.019
- fix deflate
- add broken tests with 30x without Location and other strange codes with body
2015/06/25 0.018
- works with 5.8.9 now
- no longer needs AnyEvent and Compress::Zlib (less dependecies),
  make dependency for Compress::Raw::Zlib explicit in Makefile.PL
- Net::PcapWriter now optional, i.e. only needed when writing pcaps
- count evasions and add number during submission
- use accept header from original request inXHR or use custom accept header
- increase timeout to 5s
- compatibility with MSIE8 by adding try{..} around console.log
2015/06/24 0.017
- support for MSIE autodetect starting with MSIE8
- better distinction between valid and invalid uncommon responses
- better structured tests
2015/06/23 0.016
- improved Ajax based bulk detection: timeouts, progress indicator...
2015/06/22 0.015
- Ajax based bulk detection of browser quirks and evasion possibilities
- better color coding of responses for non-ajax tests
2015/06/18 0.014
- add tests for more broken stacks, check for HTTP/0.9
2015/05/13 0.013
- add even more tests for dubious content-length
2015/05/03 0.012
- add more tests with chunking and more dubious content-length
2013/07/09 0.011
- added tests with dubious content-length
2013/07/02 0.010
- add script to ping back within iframe to see, if iframe was loaded unchanged
2013/07/02 0.009
- simplify code, remove redundant code
- log access with timestamp 
- add ping back via xmlhttrequest to check if script can get loaded
2013/07/02 0.008
- added tests with unknown content-encodings
2013/07/01 0.007
- added tests with multiple content-encodings
2013/07/01 0.006
- added tests with content-encoding and transfer-encoding with various
  compressions
2013/06/30 0.005
- single part response with content-transfer-encoding base64
2013/06/24 0.004
- work with "normalized" urls, where "," got URL-encoded
2013/06/24 0.003
- added test for range header
2013/06/10 0.002
- first workable version: tests for chunking and multipart messages