Curse Maven Snippet
What's new
- Fixed Referer-based bypass in the HTTP port reverse proxy that let attackers reach arbitrary paths on upstream ports
- Fixed path traversal in the HTTP port reverse proxy via
../ percent-encoded variants escaping the mounted route prefix - HTTP port reverse proxy now forwards only an allow-list of request headers to upstreams, preventing header smuggling (
Authorization,Cookie,X-Forwarded-*, etc.) to localhost services - Added support for modern and HD skins to
ClientUtil.drawPlayerFace(moved over from Wawel Auth)
All Relations
- All Relations
- Embedded Library
- Optional Dependency
- Required Dependency
- Tool
- Incompatible
- Include
