[Security] Bump uvicorn from 0.10.3 to 0.11.7

[dependabot-preview]

Bumps uvicorn from 0.10.3 to 0.11.7. This update includes security fixes.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Log injection in uvicorn This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file).

Affected versions: < 0.11.7

Sourced from The GitHub Security Advisory Database.

HTTP response splitting in uvicorn This affects all versions of package uvicorn. Uvicorn's implementation of the HTTP protocol for the httptools parser is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.

Affected versions: < 0.11.7

Release notes

Sourced from uvicorn's releases.

Version 0.11.7

0.11.7

• SECURITY FIX: Prevent sending invalid HTTP header names and values.
• SECURITY FIX: Ensure path value is escaped before logging to the console.

Version 0.11.6

• Fix overriding the root logger.

Version 0.11.5

• Revert "Watch all files, not just .py" due to unexpected side effects.
• Revert "Pass through gunicorn timeout config." due to unexpected side effects.

Version 0.11.4

• Use watchgod, if installed, for watching code changes.
• Reload application when any files in watched directories change, not just .py files.

Changelog

Sourced from uvicorn's changelog.

0.11.7

• SECURITY FIX: Prevent sending invalid HTTP header names and values.
• SECURITY FIX: Ensure path value is escaped before logging to the console.

0.11.6

• Fix overriding the root logger.

0.11.5

• Revert "Watch all files, not just .py" due to unexpected side effects.
• Revert "Pass through gunicorn timeout config." due to unexpected side effects.

0.11.4

• Use watchgod, if installed, for watching code changes.
• Watch all files, not just .py.
• Pass through gunicorn timeout config.

0.11.3

• Update dependencies.

0.11.2

• Don't open socket until after application startup.
• Support --backlog.

0.11.1

• Use a more liberal h11 dependency. Either 0.8.* or `0.9.*``.

0.11.0

• Fix reload/multiprocessing on Windows with Python 3.8.
• Drop IOCP support. (Required for fix above.)
• Add uvicorn --version flag.
• Add --use-colors and --no-use-colors flags.
• Display port correctly, when auto port selection isused with --port=0.

0.10.8

• Fix reload/multiprocessing error.

0.10.7

• Use resource_sharer.DupSocket to resolve socket sharing on Windows.

0.10.6

Commits

• 178bee6 Version 0.11.7 (#726)
• a796e1d Corrected --proxy-headers client ip/host when using a unix socket (#636)
• 895807f Quote path component before logging (#724)
• 789e2f1 Disallow invalid header characters (#725)
• 81f2136 Brings back windows testing to CI (#685)
• f623916 Release version 0.11.6 (#705)
• 6757386 Removing iocp mentions from documentation (#692)
• 77468df Add --app-dir option for running uvicorn from any location (#619)
• 9b92925 Document default backlog setting (#682)
• 2dcbb13 Fix typo. (#676)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

[codecov]

Codecov Report

Merging #261 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #261   +/-   ##
=======================================
  Coverage   35.26%   35.26%           
=======================================
  Files          35       35           
  Lines        2362     2362           
=======================================
  Hits          833      833           
  Misses       1529     1529           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b2de532...d11f153. Read the comment docs.