Antalya 26.3: Bump to 26.3.60

base/poco/Net/src/HTTPRequest.cpp

@@ -18,6 +18,7 @@
 #include "Poco/NumberFormatter.h"
 #include "Poco/Ascii.h"
 #include "Poco/String.h"
+#include "Poco/Exception.h"
 
 
 using Poco::NumberFormatter;
@@ -190,8 +191,31 @@ void HTTPRequest::setProxyCredentials(const std::string& scheme, const std::stri
 }
 
 
+namespace
+{
+	bool hasLineBreak(const std::string& value)
+	{
+		return value.find_first_of("\r\n") != std::string::npos;
+	}
+
+	/// CR or LF in the request line or in a header would let the value inject headers or a whole second request.
+	void checkNoLineBreaks(const HTTPRequest& request)
+	{
+		if (hasLineBreak(request.getMethod()) || hasLineBreak(request.getURI()) || hasLineBreak(request.getVersion()))
+			throw InvalidArgumentException("HTTP request line contains CR or LF");
+		for (const auto& header : request)
+		{
+			if (hasLineBreak(header.first) || hasLineBreak(header.second))
+				throw InvalidArgumentException("HTTP request header contains CR or LF", header.first);
+		}
+	}
+}
+
+
 void HTTPRequest::write(std::ostream& ostr) const
 {
+	checkNoLineBreaks(*this);
+
 	ostr << _method << " " << _uri << " " << getVersion() << "\r\n";
 	HTTPMessage::write(ostr);
 	ostr << "\r\n";

base/poco/Redis/include/Poco/Redis/Array.h

@@ -301,10 +301,34 @@ namespace Redis
             return result.str();
         }
 
+        /// The maximum allowed nesting depth of arrays in a reply.
+        /// Replies of real Redis servers are nested only a few levels deep,
+        /// while unbounded nesting would lead to stack overflow in the recursive parser.
+        static constexpr int MAX_NESTING_DEPTH = 128;
+
         static void read(RedisInputStream & input, Array & value)
         {
             value.clear();
 
+            struct DepthGuard
+            {
+                explicit DepthGuard(int & depth_) : depth(depth_)
+                {
+                    ++depth;
+                }
+
+                ~DepthGuard()
+                {
+                    --depth;
+                }
+
+                int & depth;
+            };
+
+            DepthGuard depth_guard(input.arrayNestingDepth());
+            if (depth_guard.depth > MAX_NESTING_DEPTH)
+                throw RedisException("Too deep nesting of arrays in the answer received from Redis server");
+
             Int64 length = NumberParser::parse64(input.getline());
 
             if (length != -1)

base/poco/Redis/include/Poco/Redis/RedisStream.h

@@ -107,9 +107,22 @@ namespace Redis
         std::string getline();
         /// Redis uses \r\n as delimiter. This getline version removes
         /// the \r from the result.
+
+        int & arrayNestingDepth();
+        /// Returns the current nesting depth of arrays being read from the stream.
+        /// Used to limit the recursion depth while parsing nested arrays.
+
+    private:
+        int _arrayNestingDepth = 0;
     };
 
 
+    inline int & RedisInputStream::arrayNestingDepth()
+    {
+        return _arrayNestingDepth;
+    }
+
+
 }
 } // namespace Poco::Redis
 

base/poco/Redis/src/Client.cpp

@@ -175,10 +175,23 @@ RedisType::Ptr Client::readReply()
 	RedisType::Ptr result = RedisType::createRedisType(c);
 	if (result.isNull())
 	{
+		/// The stream is not at a reply boundary anymore, so the connection cannot be reused.
+		disconnect();
 		throw RedisException("Invalid Redis type returned");
 	}
 
-	result->read(*_input);
+	try
+	{
+		result->read(*_input);
+	}
+	catch (...)
+	{
+		/// A partially read reply leaves unread data in the stream.
+		/// If the connection were reused (e.g. returned to a pool), the next request
+		/// would read the remainder of this reply instead of its own one.
+		disconnect();
+		throw;
+	}
 
 	return result;
 }

base/poco/XML/CMakeLists.txt

@@ -9,6 +9,7 @@ add_library (Poco::XML::Expat ALIAS _poco_xml_expat)
 target_compile_options (_poco_xml_expat
     PRIVATE
         -Wno-cast-qual
+        -Wno-disabled-macro-expansion
         -Wno-empty-translation-unit
         -Wno-extra-semi-stmt
         -Wno-implicit-fallthrough
@@ -49,6 +50,7 @@ target_compile_options (_poco_xml
         -Wno-unreachable-code
         -Wno-unreachable-code-break
         -Wno-unreachable-code-fallthrough
+        -Wno-unreachable-code-return
         -Wno-unused-macros
         -Wno-unused-parameter
         -Wno-zero-as-null-pointer-constant

base/poco/XML/include/Poco/XML/expat.h

@@ -20,6 +20,7 @@
    Copyright (c) 2023      Sony Corporation / Snild Dolkow <snild@sony.com>
    Copyright (c) 2024      Taichi Haradaguchi <20001722@ymail.ne.jp>
    Copyright (c) 2025      Matthew Fernandez <matthew.fernandez@gmail.com>
+   Copyright (c) 2026      Braian Plaku <braianplaku@gmail.com>
    Licensed under the MIT license:
 
    Permission is hereby granted, free of charge, to any person obtaining
@@ -40,12 +41,14 @@
    DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
    OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
    USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+   SPDX-License-Identifier: MIT
 */
 
 #ifndef Expat_INCLUDED
 #  define Expat_INCLUDED 1
 
-#  include <stdint.h> // for uint8_t
+#  include <stdint.h> // for int64_t, uint8_t, uint64_t
 #  include <stdlib.h>
 #  include "expat_external.h"
 
@@ -137,6 +140,26 @@ enum XML_Error {
   XML_ERROR_NOT_STARTED,
 };
 
+/* Added in 2.9.0. */
+enum XML_Prop_Error {
+  XML_PROP_ERROR_NONE = 0, // i.e. success
+
+  XML_PROP_ERROR_INVALID_KEY = 1,   // i.e. the property is not known at all
+  XML_PROP_ERROR_INVALID_TYPE = 2,  // i.e. the property is known but expects a
+                                    // different type (so a different
+                                    // getter/setter would need to be called)
+  XML_PROP_ERROR_INVALID_VALUE = 3, // i.e. the value is invalid (with a setter
+                                    // function) or a NULL-pointer (with a
+                                    // getter function)
+
+  XML_PROP_ERROR_PARSER_NULL = 4,     // i.e. the parser argument is NULL
+  XML_PROP_ERROR_PARSER_NOT_ROOT = 5, // i.e. the parser is not a root parser
+                                      // but a subparser (and a root parser is
+                                      // needed)
+
+  /* potentially more error codes upcoming here */
+};
+
 enum XML_Content_Type {
   XML_CTYPE_EMPTY = 1,
   XML_CTYPE_ANY,
@@ -754,29 +777,6 @@ XML_GetSpecifiedAttributeCount(XML_Parser parser);
 XMLPARSEAPI(int)
 XML_GetIdAttributeIndex(XML_Parser parser);
 
-#  ifdef XML_ATTR_INFO
-/* Source file byte offsets for the start and end of attribute names and values.
-   The value indices are exclusive of surrounding quotes; thus in a UTF-8 source
-   file an attribute value of "blah" will yield:
-   info->valueEnd - info->valueStart = 4 bytes.
-*/
-typedef struct {
-  XML_Index nameStart;  /* Offset to beginning of the attribute name. */
-  XML_Index nameEnd;    /* Offset after the attribute name's last byte. */
-  XML_Index valueStart; /* Offset to beginning of the attribute value. */
-  XML_Index valueEnd;   /* Offset after the attribute value's last byte. */
-} XML_AttrInfo;
-
-/* Returns an array of XML_AttrInfo structures for the attribute/value pairs
-   passed in last call to the XML_StartElementHandler that were specified
-   in the start-tag rather than defaulted. Each attribute/value pair counts
-   as 1; thus the number of entries in the array is
-   XML_GetSpecifiedAttributeCount(parser) / 2.
-*/
-XMLPARSEAPI(const XML_AttrInfo *)
-XML_GetAttributeInfo(XML_Parser parser);
-#  endif
-
 /* Parses some input. Returns XML_STATUS_ERROR if a fatal error is
    detected.  The last call to XML_Parse must have isFinal true; len
    may be zero for this call (or any other).
@@ -919,7 +919,9 @@ XML_SetParamEntityParsing(XML_Parser parser,
    Returns 1 if successful, 0 when called after parsing has started.
    Note: If parser == NULL, the function will do nothing and return 0.
    DEPRECATED since Expat 2.8.0.
+   Please use XML_SetHashSalt16Bytes instead.
 */
+XML_ATTR_DEPRECATED("please use XML_SetHashSalt16Bytes instead")
 XMLPARSEAPI(int)
 XML_SetHashSalt(XML_Parser parser, unsigned long hash_salt);
 
@@ -959,15 +961,24 @@ XML_GetErrorCode(XML_Parser parser);
    return 0 to indicate an error.
    Note: XML_GetCurrentByteIndex returns -1 to indicate an error.
 */
+XML_ATTR_DEPRECATED("please use XML_GetCurrentLineNumber64 instead")
 XMLPARSEAPI(XML_Size) XML_GetCurrentLineNumber(XML_Parser parser);
+XMLPARSEAPI(uint64_t) XML_GetCurrentLineNumber64(XML_Parser parser);
+XML_ATTR_DEPRECATED("please use XML_GetCurrentColumnNumber64 instead")
 XMLPARSEAPI(XML_Size) XML_GetCurrentColumnNumber(XML_Parser parser);
+XMLPARSEAPI(uint64_t) XML_GetCurrentColumnNumber64(XML_Parser parser);
+XML_ATTR_DEPRECATED("please use XML_GetCurrentByteIndex64 instead")
 XMLPARSEAPI(XML_Index) XML_GetCurrentByteIndex(XML_Parser parser);
+XMLPARSEAPI(int64_t) XML_GetCurrentByteIndex64(XML_Parser parser);
 
 /* Return the number of bytes in the current event.
    Returns 0 if the event is in an internal entity.
 */
+XML_ATTR_DEPRECATED("please use XML_GetCurrentByteCount64 instead")
 XMLPARSEAPI(int)
 XML_GetCurrentByteCount(XML_Parser parser);
+XMLPARSEAPI(uint64_t)
+XML_GetCurrentByteCount64(XML_Parser parser);
 
 /* If XML_CONTEXT_BYTES is >=1, returns the input buffer, sets
    the integer pointed to by offset to the offset within this buffer
@@ -979,8 +990,11 @@ XML_GetCurrentByteCount(XML_Parser parser);
    NOTE: The character pointer returned should not be used outside
    the handler that makes the call.
 */
+XML_ATTR_DEPRECATED("please use XML_GetInputContext64 instead")
 XMLPARSEAPI(const char *)
 XML_GetInputContext(XML_Parser parser, int *offset, int *size);
+XMLPARSEAPI(const char *)
+XML_GetInputContext64(XML_Parser parser, int64_t *offset, uint64_t *size);
 
 /* For backwards compatibility with previous versions. */
 #  define XML_GetErrorLineNumber XML_GetCurrentLineNumber
@@ -1035,11 +1049,15 @@ enum XML_FeatureEnum {
   XML_FEATURE_UNICODE_WCHAR_T,
   XML_FEATURE_DTD,
   XML_FEATURE_CONTEXT_BYTES,
+  /* Added in Expat 1.95.5, removed in Expat 2.9.0. */
   XML_FEATURE_MIN_SIZE,
   XML_FEATURE_SIZEOF_XML_CHAR,
   XML_FEATURE_SIZEOF_XML_LCHAR,
+  /* Added in Expat 2.0.0. */
   XML_FEATURE_NS,
+  /* Added in Expat 2.0.1. */
   XML_FEATURE_LARGE_SIZE,
+  /* Added in Expat 2.1.0, removed in Expat 2.9.0. */
   XML_FEATURE_ATTR_INFO,
   /* Added in Expat 2.4.0. */
   XML_FEATURE_BILLION_LAUGHS_ATTACK_PROTECTION_MAXIMUM_AMPLIFICATION_DEFAULT,
@@ -1061,6 +1079,41 @@ typedef struct {
 XMLPARSEAPI(const XML_Feature *)
 XML_GetFeatureList(void);
 
+/* Added in Expat 2.9.0. */
+enum XML_Parser_Property {
+#  if defined(XML_TESTING)
+  XML_PROP_INVALID = 0,
+#  endif
+#  if XML_GE == 1
+  XML_PROP_ALLOC_TRACKER_ACTIVATION_THRESHOLD = 1,   // of type `uint64_t`
+  XML_PROP_ALLOC_TRACKER_MAXIMUM_AMPLIFICATION = 2,  // of type `double`
+  XML_PROP_BILLION_LAUGHS_ACTIVATION_THRESHOLD = 3,  // of type `uint64_t`
+  XML_PROP_BILLION_LAUGHS_MAXIMUM_AMPLIFICATION = 4, // of type `double`
+#  endif
+  XML_PROP_REPARSE_DEFERRAL_ENABLED = 5, // of type `XML_Bool`
+  /* more properties upcoming here */
+};
+
+/* Added in Expat 2.9.0. */
+XMLPARSEAPI(enum XML_Prop_Error)
+XML_GetPropertyBool(XML_Parser parser, enum XML_Parser_Property property,
+                    XML_Bool *value);
+XMLPARSEAPI(enum XML_Prop_Error)
+XML_GetPropertyDouble(XML_Parser parser, enum XML_Parser_Property property,
+                      double *value);
+XMLPARSEAPI(enum XML_Prop_Error)
+XML_GetPropertyUInt64(XML_Parser parser, enum XML_Parser_Property property,
+                      uint64_t *value);
+XMLPARSEAPI(enum XML_Prop_Error)
+XML_SetPropertyBool(XML_Parser parser, enum XML_Parser_Property property,
+                    XML_Bool value);
+XMLPARSEAPI(enum XML_Prop_Error)
+XML_SetPropertyDouble(XML_Parser parser, enum XML_Parser_Property property,
+                      double value);
+XMLPARSEAPI(enum XML_Prop_Error)
+XML_SetPropertyUInt64(XML_Parser parser, enum XML_Parser_Property property,
+                      uint64_t value);
+
 #  if defined(XML_DTD) || (defined(XML_GE) && XML_GE == 1)
 /* Added in Expat 2.4.0 for XML_DTD defined and
  * added in Expat 2.6.0 for XML_GE == 1. */
@@ -1093,8 +1146,8 @@ XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled);
    See https://semver.org
 */
 #  define XML_MAJOR_VERSION 2
-#  define XML_MINOR_VERSION 8
-#  define XML_MICRO_VERSION 2
+#  define XML_MINOR_VERSION 9
+#  define XML_MICRO_VERSION 0
 
 #  ifdef __cplusplus
 }

base/poco/XML/include/Poco/XML/expat_external.h

@@ -16,6 +16,7 @@
    Copyright (c) 2017      Rhodri James <rhodri@wildebeest.org.uk>
    Copyright (c) 2018      Yury Gribov <tetra2005@gmail.com>
    Copyright (c) 2026      Matthew Fernandez <matthew.fernandez@gmail.com>
+   Copyright (c) 2026      Braian Plaku <braianplaku@gmail.com>
    Licensed under the MIT license:
 
    Permission is hereby granted, free of charge, to any person obtaining
@@ -36,6 +37,8 @@
    DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
    OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
    USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+   SPDX-License-Identifier: MIT
 */
 
 #ifndef Expat_External_INCLUDED
@@ -123,6 +126,17 @@
 #    define XML_ATTR_ALLOC_SIZE(x)
 #  endif
 
+/* Marks a function that Expat still provides but that callers should move off
+   of. */
+#  if defined(__clang__) || defined(__GNUC__)
+#    define XML_ATTR_DEPRECATED(message)                                       \
+      __attribute__((__deprecated__(message)))
+#  elif defined(_MSC_VER)
+#    define XML_ATTR_DEPRECATED(message) __declspec(deprecated(message))
+#  else
+#    define XML_ATTR_DEPRECATED(message) // empty i.e. no deprecation
+#  endif
+
 #  define XMLPARSEAPI(type) XMLIMPORT type XMLCALL
 
 #  ifdef __cplusplus
@@ -152,6 +166,9 @@ typedef char XML_LChar;
 #  endif   /* XML_UNICODE */
 
 #  ifdef XML_LARGE_SIZE /* Use large integers for file/stream positions. */
+#    if defined(__clang__) || defined(__GNUC__)
+#      warning Macro XML_LARGE_SIZE is deprecated, please use the 64bit location API functions instead.
+#    endif
 typedef long long XML_Index;
 typedef unsigned long long XML_Size;
 #  else

base/poco/XML/src/ascii.h

@@ -31,6 +31,8 @@
    DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
    OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
    USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+   SPDX-License-Identifier: MIT
 */
 
 #define ASCII_A 0x41

base/poco/XML/src/asciitab.h

@@ -30,6 +30,8 @@
    DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
    OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
    USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+   SPDX-License-Identifier: MIT
 */
 
 /* 0x00 */ BT_NONXML, BT_NONXML, BT_NONXML, BT_NONXML,