Security fixes

• The string sequence </ is now encoded as <\/ by the JSON module to avoid a common XSS attack vector
• Markdown embedded URLs are now filtered by a whitelist to avoid URL based XSS exploits - issue #1845, pull #1846

Bug fixes

• Fixed parsing of "tcp://" URLs - issue #1732, pull #1733
• Fixed using HTTP together with USDS sockets in the HTTP client (by Johannes Pfau aka jpf91) - pull #1747
• Fixed readUntilSmall/readLine to handle alternating availability of a peek buffer - issue #1741, pull #1761
• Fixed the JSON generator to output valid JSON for Json.undefined values (by by Tomáš Chaloupka) - pull #1737, issue #1735
• Fixed parseMultiPartForm to handle unquoted strings in the "Content-Disposition" header (by Tomáš Chaloupka) - issue #1562 pull #1725
• Fixed the session life time in RedisSessionStore to be refreshed on every access to the session (by Steven Schveighoffer) - pull #1777
• Fixed HTTPServerRequest.fullURL for IPv6 address based host strings
• Fixed "SSL_read was unsuccessful with ret 0" errors in the OpenSSL TLS implementation (by machindertech) - issue #1124, pull #1395
• Fixed an intermittent failure at shutdown when using libasync - pull #1837
• Fixed a possible range error in the libasync driver
• Fixed TaskPipe.write to throw an exception when the pipe is already closed
• Fixed MongoCursor.limit (by Jan Jurzitza aka WebFreak) - issue #967, pull #1871

Download

http://code.dlang.org/packages/vibe-d/0.7.32

http://vibed.org/download?file=vibed-0.7.32.zip

https://github.com/rejectedsoftware/vibe.d/tree/2d406bf880fa1b2bed0f3dc3ec6d9a6227f85975