GETTY / HTTP-Body-1.24_01 / Changes 
This file documents the revision history for Perl extension HTTP::Body.

1.24_01   2026-10-27 18:33:44+01:00 Europe/Berlin (TRIAL RELEASE)
	- SECURITY, CVE-2026-117500: the suffix of an upload's filename is
	  worked out from its last 255 bytes only, only when $file_temp_suffix
	  is unset, and for the default $basename_regexp by a string search
	  instead of the regexp; a filename of many dots ending in a backslash
	  made the default $basename_regexp take time quadratic in its length
	  (7 s per part at the 32 KiB header limit, once per part) in the
	  default configuration
	- SECURITY, CVE-2026-117501: a chunked body is framed line by line with
	  a limit on the chunk-size line ($HTTP::Body::max_chunk_line_size,
	  1024 bytes), chunk data is passed on as it arrives instead of being
	  held until the chunk is complete, malformed framing (a line that is
	  no chunk-size line, a size that does not fit an integer, chunk data
	  not followed by CRLF) croaks instead of buffering forever, and
	  nothing after the last chunk or after the body parser is done is kept
	- XFormsMultipart: a part other than the start part now gets its
	  temporary file and the NUL strip of RT#123615 like any upload; it used
	  to be returned by upload without a tempname, its data dropped
	- parse_header: a continuation line at the start of a part's header
	  block is dropped instead of dying, and a line that is no header field
	  is dropped instead of being stored under a made-up field name
	- add: the caller's buffer is no longer modified in place when it
	  exceeds the Content-Length, so a read-only value is accepted

1.24      2026-10-26 18:28:01+01:00 Europe/Berlin
	- SECURITY, CVE-2026-116131: urlencoded bodies are limited to
	  $HTTP::Body::UrlEncoded::max_params fields and multipart bodies to
	  $HTTP::Body::MultiPart::max_parts parts (1000 each); reported and
	  patched by CPANSec
	- SECURITY, CVE-2026-116132: the temporary file of an upload that is
	  still incomplete at DESTROY-time is now always deleted; reported and
	  patched by CPANSec (also fixes RT#84004)
	- SECURITY, CVE-2026-116133: a multipart body without a boundary or with
	  a malformed delimiter line no longer takes quadratic time; a malformed
	  delimiter line now croaks, and padding or an epilogue after the close
	  delimiter is accepted; reported and patched by CPANSec
	- SECURITY, CVE-2026-116134: a multipart part's header block is limited
	  to $HTTP::Body::MultiPart::max_header_size bytes (32768) and
	  $HTTP::Body::MultiPart::max_header_lines lines (100); reported and
	  patched by CPANSec
	- SECURITY, CVE-2026-116135: mixed-case percent escapes (e.g. %aB) in
	  urlencoded bodies are decoded instead of being dropped; reported and
	  patched by CPANSec
	- SECURITY, CVE-2026-116285: the chunk size line of a chunked body is
	  matched in linear instead of quadratic time
	- SECURITY, CVE-2026-116531: a chunked body is now framed independently
	  of where the reads feeding add() fall; a read that split a chunk could
	  leave the parser never reaching 'done', hanging a server that reads
	  until done
	- INCOMPATIBLE: add() now croaks when one of the new limits is exceeded.
	  Raise the variable, or set it to 0 to disable that limit, if your
	  forms need more. See NOTES in HTTP::Body.
	- RT#105021: temp-file write errors in MultiPart and OctetStream now
	  croak instead of silently truncating the stored body
	- RT#123615: a NUL byte in a multipart filename is stripped so it cannot
	  truncate a path handed on downstream
	- Moved repository from Shadowcat git to GitHub (libwww-perl/HTTP-Body)
	- Updated all metadata resources to point to GitHub
	- Fixed prerequisites: moved Digest::MD5 to test deps, changed HTTP::Headers to HTTP::Message
	- Added README.md for GitHub
	- Updated support section in documentation
	- Moved the POD, POD coverage and Perl::Critic tests to xt/release, so
	  they run on every release instead of being skipped

1.23      2024-03-30 04:27:56+01:00 Europe/Berlin
	- Changing default behavior of upload handling to stop taking over the upload extension
	- Adding configuration options for changing this behavior back or add custom File::Temp arguments
	- Updating documentation.

1.22      2015-01-29 04:51:51+01:00 Europe/Berlin
        - Fix for the fix..... don't ask

1.21      2015-01-29 04:48:58+01:00 Europe/Berlin
	- Fix for failing test if Plack is not installed

1.20      2015-01-28 16:20:59+01:00 Europe/Berlin
        -new method 'part_data' which preserves multipart meta information just in cause
          you have a form upload with unexpected charsets, etc.

1.19
        - Release for cleanup of dzil

1.18      2013-12-06 10:05:33 America/New_York
        - Added configurable basename regexp, test added with fixed regexp for next release
          (Torsten Raudssus [GETTY])
        - Added .gitignore

1.16    Wed, 3 Oct 2012 15:18:47 CET
        - Added support for application/json (Gareth Kirwan [GBJK])

1.15    Mon, 5 Dec 2011 02:59:02 CET
        - Added missing requirement (Torsten Raudssus [GETTY])

1.14    Tue 26 Oct 2010 19:42:00 CET
        - removed benchmark test data and benchmark script for release (Torsten Raudssus [GETTY])

1.12    Sat 19 Mar 2011 19:05:17 CET
        - Fixed the t/08 test

1.11    Tue 26 Oct 2010 14:10:00 UTC
        - Added param_order capability (Torsten Raudssus [GETTY])

1.10    Fri 8 Oct 2010 15:50:55 UTC
        - Patch for test failure ( thanks KENTNL/MITHALDU! )

1.09    Thu 19 Aug 2010 19:08:55 UTC
        - remove blib for PAUSE indexing.

1.08    Thu 19 Aug 2010 18:08:42 UTC
        - Temp files now preserve the suffix of the uploaded file. This makes
          it possible to feed the file directly into a mime-type-determining
          module that may rely on this suffix as part of its heuristic. (Dave
          Rolsky)
        - Fix for RT#54443 Xforms buffering incorrectly (Simon Elliott)
        - Move to Dist::Zilla

1.07    2010-01-24 20:40:00
        - Up IO::File dependency.

1.06    2010-01-09 19:21:00
        - Added $body->cleanup(1) flag to enable auto-deletion of temporary files
          during DESTROY. (Vany Serezhkin)
        - Fixed parsing of multipart bodies with boundaries that contain commas.
          (Tomas Doran, http://rt.cpan.org/Public/Bug/Display.html?id=41407)
        - Dropped YAML, we now use Perl as a serialization format in our tests. We call this PAML ;)

1.05    2008-12-01 17:15:00
        - Removed useless eval + require in new().

1.04    2008-06-23 16:00:00
        - Added tmpdir() accessor to specify an alternate directory for temp files.
          (jgoulah)

1.03    2008-04-07 08:20:00
        - Set body value for XForms data. (Daniel Ruoso)

1.02    2008-02-27 17:30:00
        - Fixed issue with urlencoded test on Windows.

1.01    2008-02-23 11:30:00
        - Fixed performance issue with urlencoded regex.

1.00    2008-02-23 11:00:00
        - Added support for chunked requests if no $length value is passed to new().
        - Added support for XForms submissions. (Daniel Ruoso)
        - Fixed urlencoded parser to handle spaces after semicolons and equal signs
          in the value. (Tom Heady, http://rt.cpan.org/Ticket/Display.html?id=31055)
        - Fixed multipart test to properly clean up temporary files.

0.9   2007-03-27 14:00:00
        - Fixed bug where empty fields in multipart/form-data were ignored.
          (Ton Voon)
        - Fixed bug where an uploaded file with the name "0" was ignored.
          (Ton Voon)
        - Small performance improvements to urlencoded parser.

0.8   2007-03-23 18:40:00
        - Some browsers such as MSIE send extra data after the body content.
          We now properly ignore anything beyond Content-Length.

0.7   2007-03-23 10:00:00
        - Fixed parsing an empty (zero-length) file using multipart.
          http://rt.cpan.org/NoAuth/Bug.html?id=25392

0.6   2006-01-06 00:00:00
        - Fixed buffer bug in OctetStream, reported by Daisuke Murase
          <typester@cpan.org>.
        - Fixed YAML prereq, reported by Jess Robinson
        - Added tests, Ben Trott <ben@sixapart.com>.

0.5   2005-11-17 00:00:00
        - Updated for PAR compatibility

0.4   2005-11-09 01:00:00
        - Version bump to 0.4 so CPAN.pm installs the right version.

0.03  2005-10-27 20:00:00
        - removed use of List::Util first due to memory leakage.
          http://rt.cpan.org/NoAuth/Bug.html?id=13891

0.2   2005-10-07
        - fixed POD

0.01  2005-09-07
        - first release