<!--
 File        :  doc/source/changelog.sgml

 Purpose     :  Entity included in other project documents.

 Copyright (C) 2013-2026 Privoxy Developers https://www.privoxy.org/
 See LICENSE.

 ======================================================================
  This file used for inclusion with other documents only.
 ======================================================================

 If you make changes to this file, please verify the finished
 docs all display as intended.

 This file is included into:

  user-manual
-->


<!--
 The SGML ChangeLog can be generated with: utils/changelog2doc.pl ChangeLog
-->

<para>
  <application>Privoxy 4.2.0</application> fixes a couple of bugs and
  brings general improvements such as support for elliptic-curve keys.
</para>
<para>
  Two potential security problems have been reported and addressed.
</para>
<para>
  Changes in <application>Privoxy 4.2.0</application> stable:
</para>
<para>
 <itemizedlist>
  <listitem>
   <para>
    Security improvements:
    <itemizedlist>
    <listitem>
     <para>
      Parse the chunk-size with a dedicated function and reject "unreasonably"
      large values to prevent silent truncation by sscanf(), integer overflows
      and misinterpretation of the content later on. Heap buffer overflows on
      platforms with 32-bit pointers were alleged as well.
      Commit 5b3bb22b77. OVE-20260515-0002. Reported by @TristanInSec.
     </para>
    </listitem>
    <listitem>
     <para>
      ssl_send_certificate_error(): Store the generated message on the heap
      instead of the stack to prevent an alleged segmentation fault if there
      are enough certificates in the chain to exceed the stack size.
      While at it, replace another variable-length array that was probably
      unproblematic with a heap-based buffer as well.
      Commit 4963aa4f08. OVE-20260515-0001. Reported by @TristanInSec.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Bug fixes:
    <itemizedlist>
    <listitem>
     <para>
      block_acl(): Ignore ACL matches when we don't have a destination yet
      but the ACL requires one to match. block_acl() will be called
      again later on when the destination is known from parsing the request.
      Fixes SF bug #913 reported by Rainer Sokoll  with confirmation from
      Peter Geelhoed.
     </para>
    </listitem>
    <listitem>
     <para>
      rfc2553_connect_to(): Prevent theoretical memory disclosure through
      the CGI interface if a request is rejected due to ACLs. It's theoretical
      due to the previous bug in the ACL code.
     </para>
    </listitem>
    <listitem>
     <para>
      send_http_request(): Give up on the client connection if writing the
      request data failed. If there's a request body Privoxy may not have
      read all the data yet. The issue could be reproduced by running the
      upstream curl test 1293 multiple times in a row.
     </para>
    </listitem>
    <listitem>
     <para>
      load_one_re_filterfile(): Only register content filters for statistics.
      Previously all filter types were registered which wasted a bit of memory.
     </para>
    </listitem>
    <listitem>
     <para>
      Prevent unused-variable warnings when compiling with
      DISABLE_PCRE_JIT_COMPILATION defined.
     </para>
    </listitem>
    <listitem>
     <para>
      cgi_show_url_info(): Remove special handling of "standard.action".
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    General improvements:
    <itemizedlist>
    <listitem>
     <para>
      Add elliptic-curve-keys directive and enable it by default.
      It lets Privoxy use the SN_X9_62_prime256v1 group instead of RSA when
      generating website keys and certificates. This is expected to be faster
      but may not be supported by older clients. The OpenSSL-specific code is
      based on on a patch by Steven Smith submitted in SF#933.
     </para>
    </listitem>
    <listitem>
     <para>
      Check the listening address when deciding whether or not a client tag
      matches. This allows to use different client tags for different clients
      running on the same host.
     </para>
    </listitem>
    <listitem>
     <para>
      Add code to make debugging ACL rules more convenient. It can be enabled
      with the new configure parameter --enable-acl-debugging.
     </para>
    </listitem>
    <listitem>
     <para>
      acl_addr(): Properly reject IPv6 addresses when compiled without RFC2553 support.
     </para>
    </listitem>
    <listitem>
     <para>
      Use separate linked lists for filters of different types to be able look up
      filters more efficiently. Implements TODO item #96.
     </para>
    </listitem>
    <listitem>
     <para>
      Allow to set and unset external filters through the CGI editor.
     </para>
    </listitem>
    <listitem>
     <para>
      parse_acl_rule(): Include the config file line number in the error messages.
     </para>
    </listitem>
    <listitem>
     <para>
      wolfssl: Downgrade an error message in create_server_ssl_connection()
      to LOG_LEVEL_ERROR.
     </para>
    </listitem>
    <listitem>
     <para>
      Remove useless csp member re_filterfile_short[].
     </para>
    </listitem>
    <listitem>
     <para>
      templates: Update description of the 'unstable' conditional symbol.
     </para>
    </listitem>
    <listitem>
     <para>
      templates/url-info-osd.xml: Update address of the Privoxy developers mailing list.
     </para>
    </listitem>
    <listitem>
     <para>
      Factor parse_acl_rule() out of load_config().
     </para>
    </listitem>
    <listitem>
     <para>
      configure.in: Don't claim that OpenSSL has been detected when it may be LibreSSL.
     </para>
    </listitem>
    <listitem>
     <para>
      configure.in: Remove code to disable pcre2. Since the removal of pcre1
      support in 24d0ff8398fdf pcre2 is no longer optional.
     </para>
    </listitem>
    <listitem>
     <para>
      Replace the term 'TLS/SSL' with 'TLS' in a bunch of places as most (all?)
      supported TLS libraries default to not supporting SSL anymore.
     </para>
    </listitem>
    <listitem>
     <para>
      utils/filter2docs.pl: Add two spaces between filter names and description
      so there's space after the longest filter name which currently is
      'allow-autocompletion'.
     </para>
    </listitem>
    <listitem>
     <para>
      utils/filter2docs.pl: Recognize filters with dots in the name.
     </para>
    </listitem>
    <listitem>
     <para>
      Remove support for mbedtls 2.x.
     </para>
    </listitem>
    <listitem>
     <para>
      Remove support for OpenSSL versions before 2.0.
     </para>
    </listitem>
    <listitem>
     <para>
      GNUMakefile.in: Remove duplicated 'only' in the web-rss-feed target's message.
     </para>
    </listitem>
    <listitem>
     <para>
      GNUMakefile.in: Add a web-rss-feed target that only syncs the RSS feed.
     </para>
    </listitem>
    <listitem>
     <para>
      GNUMakefile.in: The Privoxy tools privoxy-log-parser, privoxy-regression-test
      and uagen are handled by the "install" and "uninstall" targets now.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Action file improvements:
    <itemizedlist>
    <listitem>
     <para>
      Disable fast-redirects for "/.*&__goaway_referer=http".
     </para>
    </listitem>
    <listitem>
     <para>
      Block ".parsely.com/p(logger|x)/" to match URLs that weren't
      covered by ".pixel.parsely.com/".
     </para>
    </listitem>
    <listitem>
     <para>
      Block requests to ".siteintercept.qualtrics.com/".
     </para>
    </listitem>
    <listitem>
     <para>
      Unblock "gitlab./search/count\?".
     </para>
    </listitem>
    <listitem>
     <para>
      Reword a comment in user.action that claimed that 'we' want
      to support certain sites.
     </para>
    </listitem>
    <listitem>
     <para>
      Remove obsolete domain sunsolve.sun.com from user.action.
     </para>
    </listitem>
    <listitem>
     <para>
      Stop referring to SSL in comments.
     </para>
    </listitem>
    <listitem>
     <para>
      Disable fast-redirects for "archive.is/".
     </para>
    </listitem>
    <listitem>
     <para>
      Add example section for the taz.de filter to user.action.
     </para>
    </listitem>
    <listitem>
     <para>
      default.action.master: Update list of predefined filters.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Filter improvements:
    <itemizedlist>
    <listitem>
     <para>
      Let the "sourceforge" filter hide the "MongoDB" ad and the "vibe coding bar".
     </para>
    </listitem>
    <listitem>
     <para>
      Add a "taz.de" filter which hides the "paywahl" banner on taz.de by default.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Documentation improvements:
    <itemizedlist>
    <listitem>
     <para>
      FAQ: Mention that one can also donate through Liberapay and add a link.
     </para>
    </listitem>
    <listitem>
     <para>
      Add two paragraphs to the 'Reporting security problems' section.
      Request that use of "AI" is disclosed and that reporters respond to
      questions about the report.
     </para>
    </listitem>
    <listitem>
     <para>
      The Privoxy tools privoxy-log-parser, privoxy-regression-test and uagen
      have man pages now. Previously they were only documented in perldoc.
     </para>
    </listitem>
    <listitem>
     <para>
      user-manual: Update the content filter list.
     </para>
    </listitem>
    <listitem>
     <para>
      user-manual: Update limit-connect description. If the https-inspection action
      is enabled, Privoxy does filter the transferred content even if the CONNECT
      action is being used.
     </para>
    </listitem>
    <listitem>
     <para>
      Document that the listen-address is taken into account for client
      tags as well now.
     </para>
    </listitem>
    <listitem>
     <para>
      Update limit-connect description.
     </para>
    </listitem>
    <listitem>
     <para>
      Don't mention an obsolete mbed TLS version in the user manual's
      'Third-party licenses and copyrights' section. While at it, link to the
      GitHub page which shows the README instead of the list of tags which is
      less informative and replace an 'and' with a comma.
     </para>
    </listitem>
    <listitem>
     <para>
      Mention zstd in the user manual's 'Third-party licenses and copyrights' section.
     </para>
    </listitem>
    <listitem>
     <para>
      license.sgml: Remove incorrect comment claiming that the file is included
      into the user manual.
     </para>
    </listitem>
    <listitem>
     <para>
      Factor out license explanation into separate SGML document
      to deduplicate the content. No HTML output change intended.
     </para>
    </listitem>
    <listitem>
     <para>
      user-manual: Sync paragraph explaining the license of Privoxy binaries
      when linked to a recent TLS library with license.sgml.
     </para>
    </listitem>
    <listitem>
     <para>
      user-manual: Use &lt; instead of literal '<' to unbreak highlighting in Emacs.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Website improvements:
    <itemizedlist>
    <listitem>
     <para>
      Update doc/webserver/README.txt.
     </para>
    </listitem>
    <listitem>
     <para>
      Delete doc/webserver/redirect.php which hasn't been used in years.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Privoxy-Log-Parser:
    <itemizedlist>
    <listitem>
     <para>
      Highlight listen address in "Evaluating tag 'forward-directly' for client
      127.0.0.1 using 127.0.1.1:8120. End of life 1774948202."
     </para>
    </listitem>
    <listitem>
     <para>
      Deal with a log message containing only 'TLS' instead of 'TLS/SSL'.
     </para>
    </listitem>
    <listitem>
     <para>
      Bump version to 0.9.8.
     </para>
    </listitem>
    <listitem>
     <para>
      Highlight listen address in 'Enlisting tag 'allow-cookies' for client
      127.0.0.1 using 127.0.1.1:8120.'
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Test improvements:
    <itemizedlist>
    <listitem>
     <para>
      run-privoxy-tests.sh: Kill the whole process group if Privoxy
      doesn't start up in time. This prevents hangs when the system is
      heavily loaded, run-privoxy-test.sh's output is piped into tee(1)
      and Privoxy starts up after the the script checks for it, but before
      it exits.
     </para>
    </listitem>
    <listitem>
     <para>
      Add test for the content filter "taz.de".
     </para>
    </listitem>
    <listitem>
     <para>
      Add test scenarios for the ACL code.
     </para>
    </listitem>
    <listitem>
     <para>
      tests/cts: Make the TESTDIR available as environment variable so
      the prechecks can access it.
     </para>
    </listitem>
    <listitem>
     <para>
      Add test helper script that checks if a local address is available
      to bind to.
     </para>
    </listitem>
    <listitem>
     <para>
      run-privoxy-tests.sh: Add valgrind support that can be enabled with "-v".
     </para>
    </listitem>
    <listitem>
     <para>
      run-privoxy-tests.sh: Turn $log_file into a local variable in start_privoxy().
     </para>
    </listitem>
    <listitem>
     <para>
      tests/cts/README: Recommend to use curl upstream tag curl-8_20_0.
     </para>
    </listitem>
    <listitem>
     <para>
      Regenerate curl-test-manifest-for-privoxy.
     </para>
    </listitem>
    <listitem>
     <para>
      gen-skip-reasons.pl: Use '==' instead of 'eq' when checking whether or
      not a test should be skipped. While the script output is the same, the
      test number isn't a  string so using '==' seems more appropriate.
     </para>
    </listitem>
    <listitem>
     <para>
      gen-skip-reasons.pl: Skip test 1 due to multiple Connection header values.
     </para>
    </listitem>
    <listitem>
     <para>
      gen-skip-reasons.pl: Skip test 58 for now which doesn't work anymore after
      a recent curl upstream change.
     </para>
    </listitem>
    <listitem>
     <para>
      gen-skip-reasons.pl: Skip test 1685 which uses a Cookie header with a tab
      that Privoxy converts into a space.
     </para>
    </listitem>
    <listitem>
     <para>
      Privoxy-Regression-Test: Bump version to 0.7.6
     </para>
    </listitem>
    <listitem>
     <para>
      Privoxy-Regression-Test: Allow '!' characters which are used in URLs from
      taz.de for example.
     </para>
    </listitem>
    <listitem>
     <para>
      Privoxy-Regression-Test: Include the offending line in the error message
      when rejecting Sticky Actions with whitespace inside the action parameters.
     </para>
    </listitem>
    <listitem>
     <para>
      Add three more tests for the chunked-transfer-encoding scenario.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
 </itemizedlist>
</para>
