Require CRLF line endings in request line and headers #138

jeremyevans · 2024-06-25T21:46:03Z

Disallow bare CR, LF, NUL in header and request lines. Tighten parsing of request lines to only allow single spaces, as specified in the RFCs.

Forcing this RFC-compliant behavior breaks a lot of tests, so fix the tests to correctly use CRLF instead of LF for requests (other than the specific checks for handling of bad requests).

Fixes #137

Disallow bare CR, LF, NUL in header and request lines. Tighten parsing of request lines to only allow single spaces, as specified in the RFCs. Forcing this RFC-compliant behavior breaks a lot of tests, so fix the tests to correctly use CRLF instead of LF for requests (other than the specific checks for handling of bad requests). Fixes ruby#137

kenballus · 2024-06-25T21:55:04Z

lib/webrick/httprequest.rb

@@ -458,7 +458,7 @@ def read_request_line(socket)
      end

      @request_time = Time.now
-      if /^(\S+)\s+(\S++)(?:\s+HTTP\/(\d+\.\d+))?\r?\n/mo =~ @request_line
+      if /^(\S+) (\S++)(?: HTTP\/(\d+\.\d+))?\r\n/mo =~ @request_line


I think the old behavior is technically RFC-compliant.

RFC 9112 section 3:

Although the request-line grammar rule requires that each of the component elements be separated by a single SP octet, recipients MAY instead parse on whitespace-delimited word boundaries and, aside from the CRLF terminator, treat any form of whitespace as the SP separator while ignoring preceding or trailing whitespace; such whitespace includes one or more of the following octets: SP, HTAB, VT (%x0B), FF (%x0C), or bare CR. However, lenient parsing can result in request smuggling security vulnerabilities if there are multiple recipients of the message and each has its own unique interpretation of robustness (see Section 11.2).

That said, this isn't a bad change. Apache rejects request lines that use whitespace other than a single SP octet, so I don't think you'll break compatibility with any clients by tightening this up.

kenballus · 2024-06-25T21:58:48Z

lib/webrick/httprequest.rb

@@ -471,7 +471,7 @@ def read_request_line(socket)
    def read_header(socket)
      if socket
        while line = read_line(socket)
-          break if /\A(#{CRLF}|#{LF})\z/om =~ line
+          break if /\A#{CRLF}\z/om =~ line


Similarly, breaking lines on bare LF is allowed by the RFCs, so the old behavior was not a violation. From RFC 9112, section 2.2:

Although the line terminator for the start-line and fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR.

Again, many popular servers (Apache, Lighttpd, Node.js, Passenger, Puma) require CRLF line endings, so you're unlikely to break compatibility by joining that club.

jeremyevans · 2024-06-25T23:04:53Z

@kenballus Thank you very much for your review. Since the RFCs do not require (MAY not MUST) the loose behavior, I would feel better about making things strict in order to reduce the chance of security issues, especially since other web servers are similarly strict.

kenballus · 2024-06-25T23:07:16Z

Agreed. LGTM.

ioquatix · 2024-07-02T13:58:02Z

test/webrick/test_httprequest.rb

@@ -11,7 +11,7 @@ def teardown

  def test_simple_request
    msg = <<-_end_of_message_
-GET /
+GET /\r


Shouldn't this be \r\n?

The \n comes from the line ending (it's a heredoc).

ioquatix · 2024-07-02T13:58:27Z

test/webrick/test_httprequest.rb

@@ -77,7 +77,7 @@ def test_request_uri_too_large
    _end_of_message_
    req = WEBrick::HTTPRequest.new(WEBrick::Config::HTTP)
    assert_raise(WEBrick::HTTPStatus::RequestURITooLarge){
-      req.parse(StringIO.new(msg.gsub(/^ {6}/, "")))
+      req.parse(StringIO.new(msg.gsub(/^ {6}/, "").gsub("\n", "\r\n")))


There is a lot of duplicated setup. Would it make sense to extract it into a helper? Or use <<~ instead?

Sure. If someone wants to work on cleaning up the specs in a later PR, that would be great.

ioquatix

Basically looks okay to me, but these tests look kind of crufty in general (not the fault of the PR).

This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [webrick](https://redirect.github.com/ruby/webrick) | `1.8.1` -> `1.8.2` | [![age](https://developer.mend.io/api/mc/badges/age/rubygems/webrick/1.8.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/rubygems/webrick/1.8.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/rubygems/webrick/1.8.1/1.8.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/rubygems/webrick/1.8.1/1.8.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### HTTP Request Smuggling in ruby webrick [CVE-2024-47220](https://nvd.nist.gov/vuln/detail/CVE-2024-47220) / [GHSA-6f62-3596-g6w7](https://redirect.github.com/advisories/GHSA-6f62-3596-g6w7) <details> <summary>More information</summary> #### Details An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production." #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2024-47220](https://nvd.nist.gov/vuln/detail/CVE-2024-47220) - [ruby/webrick#145 - [https://github.com/ruby/webrick/pull/146/commits/d88321da45dcd230ac2b4585cad4833d6d5e8841](https://redirect.github.com/ruby/webrick/pull/146/commits/d88321da45dcd230ac2b4585cad4833d6d5e8841) - [https://github.com/ruby/webrick/commit/f5faca9222541591e1a7c3c97552ebb0c92733c7](https://redirect.github.com/ruby/webrick/commit/f5faca9222541591e1a7c3c97552ebb0c92733c7) - [https://github.com/ruby/webrick](https://redirect.github.com/ruby/webrick) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6f62-3596-g6w7) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>ruby/webrick (webrick)</summary> ### [`v1.8.2`](https://redirect.github.com/ruby/webrick/releases/tag/v1.8.2) [Compare Source](https://redirect.github.com/ruby/webrick/compare/v1.8.1...v1.8.2) #### What's Changed - Drop commented-out line by [@olleolleolle](https://redirect.github.com/olleolleolle) in [ruby/webrick#108 - Add Ruby 3.1 & 3.2 to CI matrix by [@tricknotes](https://redirect.github.com/tricknotes) in [ruby/webrick#109 - Fix/redos by [@ooooooo-q](https://redirect.github.com/ooooooo-q) in [ruby/webrick#114 - Raise HTTPStatus::BadRequest for requests with invalid/duplicate content-length headers by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#120 - Bump actions/checkout from 3 to 4 by [@dependabot](https://redirect.github.com/dependabot) in [ruby/webrick#121 - Improve CI by [@hsbt](https://redirect.github.com/hsbt) in [ruby/webrick#123 - Fix WEBrick::TestFileHandler#test_short_filename test not working on mswin by [@KJTsanaktsidis](https://redirect.github.com/KJTsanaktsidis) in [ruby/webrick#128 - Fix bug chunk extension detection by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#125 - Fix CI. by [@ioquatix](https://redirect.github.com/ioquatix) in [ruby/webrick#131 - Merge multiple cookie headers, preserving semantic correctness. by [@ioquatix](https://redirect.github.com/ioquatix) in [ruby/webrick#130 - Test on macos-latest by [@byroot](https://redirect.github.com/byroot) in [ruby/webrick#132 - Require CRLF line endings in request line and headers by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#138 - Prefer squigly heredocs. by [@ioquatix](https://redirect.github.com/ioquatix) in [ruby/webrick#143 - Only strip space and horizontal tab in headers by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#141 - Treat missing CRLF separator after headers as an EOFError by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#142 - Return 400 response for chunked requests with unexpected data after chunk by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#136 - Fix reference to URI::REGEXP::PATTERN::HOST by [@casperisfine](https://redirect.github.com/casperisfine) in [ruby/webrick#144 - Prevent request smuggling by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#146 #### New Contributors - [@tricknotes](https://redirect.github.com/tricknotes) made their first contribution in [ruby/webrick#109 - [@ooooooo-q](https://redirect.github.com/ooooooo-q) made their first contribution in [ruby/webrick#114 - [@KJTsanaktsidis](https://redirect.github.com/KJTsanaktsidis) made their first contribution in [ruby/webrick#128 - [@byroot](https://redirect.github.com/byroot) made their first contribution in [ruby/webrick#132 - [@casperisfine](https://redirect.github.com/casperisfine) made their first contribution in [ruby/webrick#144 **Full Changelog**: ruby/webrick@v1.8.1...v1.8.2 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" in timezone Australia/Sydney, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/google/osv.dev).

This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [webrick](https://redirect.github.com/ruby/webrick) | `1.8.1` -> `1.8.2` | [![age](https://developer.mend.io/api/mc/badges/age/rubygems/webrick/1.8.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/rubygems/webrick/1.8.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/rubygems/webrick/1.8.1/1.8.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/rubygems/webrick/1.8.1/1.8.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### HTTP Request Smuggling in ruby webrick [CVE-2024-47220](https://nvd.nist.gov/vuln/detail/CVE-2024-47220) / [GHSA-6f62-3596-g6w7](https://redirect.github.com/advisories/GHSA-6f62-3596-g6w7) <details> <summary>More information</summary> #### Details An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production." #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2024-47220](https://nvd.nist.gov/vuln/detail/CVE-2024-47220) - [ruby/webrick#145 - [https://github.com/ruby/webrick/pull/146/commits/d88321da45dcd230ac2b4585cad4833d6d5e8841](https://redirect.github.com/ruby/webrick/pull/146/commits/d88321da45dcd230ac2b4585cad4833d6d5e8841) - [https://github.com/ruby/webrick/commit/f5faca9222541591e1a7c3c97552ebb0c92733c7](https://redirect.github.com/ruby/webrick/commit/f5faca9222541591e1a7c3c97552ebb0c92733c7) - [https://github.com/ruby/webrick](https://redirect.github.com/ruby/webrick) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6f62-3596-g6w7) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>ruby/webrick (webrick)</summary> ### [`v1.8.2`](https://redirect.github.com/ruby/webrick/releases/tag/v1.8.2) [Compare Source](https://redirect.github.com/ruby/webrick/compare/v1.8.1...v1.8.2) #### What's Changed - Drop commented-out line by [@olleolleolle](https://redirect.github.com/olleolleolle) in [ruby/webrick#108 - Add Ruby 3.1 & 3.2 to CI matrix by [@tricknotes](https://redirect.github.com/tricknotes) in [ruby/webrick#109 - Fix/redos by [@ooooooo-q](https://redirect.github.com/ooooooo-q) in [ruby/webrick#114 - Raise HTTPStatus::BadRequest for requests with invalid/duplicate content-length headers by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#120 - Bump actions/checkout from 3 to 4 by [@dependabot](https://redirect.github.com/dependabot) in [ruby/webrick#121 - Improve CI by [@hsbt](https://redirect.github.com/hsbt) in [ruby/webrick#123 - Fix WEBrick::TestFileHandler#test_short_filename test not working on mswin by [@KJTsanaktsidis](https://redirect.github.com/KJTsanaktsidis) in [ruby/webrick#128 - Fix bug chunk extension detection by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#125 - Fix CI. by [@ioquatix](https://redirect.github.com/ioquatix) in [ruby/webrick#131 - Merge multiple cookie headers, preserving semantic correctness. by [@ioquatix](https://redirect.github.com/ioquatix) in [ruby/webrick#130 - Test on macos-latest by [@byroot](https://redirect.github.com/byroot) in [ruby/webrick#132 - Require CRLF line endings in request line and headers by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#138 - Prefer squigly heredocs. by [@ioquatix](https://redirect.github.com/ioquatix) in [ruby/webrick#143 - Only strip space and horizontal tab in headers by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#141 - Treat missing CRLF separator after headers as an EOFError by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#142 - Return 400 response for chunked requests with unexpected data after chunk by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#136 - Fix reference to URI::REGEXP::PATTERN::HOST by [@casperisfine](https://redirect.github.com/casperisfine) in [ruby/webrick#144 - Prevent request smuggling by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#146 #### New Contributors - [@tricknotes](https://redirect.github.com/tricknotes) made their first contribution in [ruby/webrick#109 - [@ooooooo-q](https://redirect.github.com/ooooooo-q) made their first contribution in [ruby/webrick#114 - [@KJTsanaktsidis](https://redirect.github.com/KJTsanaktsidis) made their first contribution in [ruby/webrick#128 - [@byroot](https://redirect.github.com/byroot) made their first contribution in [ruby/webrick#132 - [@casperisfine](https://redirect.github.com/casperisfine) made their first contribution in [ruby/webrick#144 **Full Changelog**: ruby/webrick@v1.8.1...v1.8.2 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" in timezone Australia/Sydney, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/google/osv-scanner).

This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [webrick](https://redirect.github.com/ruby/webrick) | `1.8.1` -> `1.8.2` | [![age](https://developer.mend.io/api/mc/badges/age/rubygems/webrick/1.8.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/rubygems/webrick/1.8.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/rubygems/webrick/1.8.1/1.8.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/rubygems/webrick/1.8.1/1.8.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2024-47220](https://nvd.nist.gov/vuln/detail/CVE-2024-47220) An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production." --- ### Release Notes <details> <summary>ruby/webrick (webrick)</summary> ### [`v1.8.2`](https://redirect.github.com/ruby/webrick/releases/tag/v1.8.2) [Compare Source](https://redirect.github.com/ruby/webrick/compare/v1.8.1...v1.8.2) #### What's Changed - Drop commented-out line by [@olleolleolle](https://redirect.github.com/olleolleolle) in [ruby/webrick#108 - Add Ruby 3.1 & 3.2 to CI matrix by [@tricknotes](https://redirect.github.com/tricknotes) in [ruby/webrick#109 - Fix/redos by [@ooooooo-q](https://redirect.github.com/ooooooo-q) in [ruby/webrick#114 - Raise HTTPStatus::BadRequest for requests with invalid/duplicate content-length headers by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#120 - Bump actions/checkout from 3 to 4 by [@dependabot](https://redirect.github.com/dependabot) in [ruby/webrick#121 - Improve CI by [@hsbt](https://redirect.github.com/hsbt) in [ruby/webrick#123 - Fix WEBrick::TestFileHandler#test_short_filename test not working on mswin by [@KJTsanaktsidis](https://redirect.github.com/KJTsanaktsidis) in [ruby/webrick#128 - Fix bug chunk extension detection by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#125 - Fix CI. by [@ioquatix](https://redirect.github.com/ioquatix) in [ruby/webrick#131 - Merge multiple cookie headers, preserving semantic correctness. by [@ioquatix](https://redirect.github.com/ioquatix) in [ruby/webrick#130 - Test on macos-latest by [@byroot](https://redirect.github.com/byroot) in [ruby/webrick#132 - Require CRLF line endings in request line and headers by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#138 - Prefer squigly heredocs. by [@ioquatix](https://redirect.github.com/ioquatix) in [ruby/webrick#143 - Only strip space and horizontal tab in headers by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#141 - Treat missing CRLF separator after headers as an EOFError by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#142 - Return 400 response for chunked requests with unexpected data after chunk by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#136 - Fix reference to URI::REGEXP::PATTERN::HOST by [@casperisfine](https://redirect.github.com/casperisfine) in [ruby/webrick#144 - Prevent request smuggling by [@jeremyevans](https://redirect.github.com/jeremyevans) in [ruby/webrick#146 #### New Contributors - [@tricknotes](https://redirect.github.com/tricknotes) made their first contribution in [ruby/webrick#109 - [@ooooooo-q](https://redirect.github.com/ooooooo-q) made their first contribution in [ruby/webrick#114 - [@KJTsanaktsidis](https://redirect.github.com/KJTsanaktsidis) made their first contribution in [ruby/webrick#128 - [@byroot](https://redirect.github.com/byroot) made their first contribution in [ruby/webrick#132 - [@casperisfine](https://redirect.github.com/casperisfine) made their first contribution in [ruby/webrick#144 **Full Changelog**: ruby/webrick@v1.8.1...v1.8.2 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/slsa-framework/slsa).  Signed-off-by: Mend Renovate <bot@renovateapp.com>

jeremyevans mentioned this pull request Jun 25, 2024

CR incorrectly permitted within header values #137

Closed

kenballus reviewed Jun 25, 2024

View reviewed changes

ioquatix reviewed Jul 2, 2024

View reviewed changes

ioquatix approved these changes Jul 2, 2024

View reviewed changes

jeremyevans merged commit ee60354 into ruby:master Jul 2, 2024
19 checks passed

nate2014jatc mentioned this pull request Sep 25, 2024

Bump webrick from 1.8.1 to 1.8.2 nate2014jatc/AGSTATUS#28

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Require CRLF line endings in request line and headers #138

Require CRLF line endings in request line and headers #138

jeremyevans commented Jun 25, 2024

kenballus Jun 25, 2024

kenballus Jun 25, 2024

jeremyevans commented Jun 25, 2024

kenballus commented Jun 25, 2024

ioquatix Jul 2, 2024

jeremyevans Jul 2, 2024

ioquatix Jul 2, 2024

ioquatix Jul 2, 2024 •

edited

Loading

jeremyevans Jul 2, 2024

ioquatix left a comment

Require CRLF line endings in request line and headers #138

Require CRLF line endings in request line and headers #138

Conversation

jeremyevans commented Jun 25, 2024

kenballus Jun 25, 2024

Choose a reason for hiding this comment

kenballus Jun 25, 2024

Choose a reason for hiding this comment

jeremyevans commented Jun 25, 2024

kenballus commented Jun 25, 2024

ioquatix Jul 2, 2024

Choose a reason for hiding this comment

jeremyevans Jul 2, 2024

Choose a reason for hiding this comment

ioquatix Jul 2, 2024

Choose a reason for hiding this comment

ioquatix Jul 2, 2024 • edited Loading

Choose a reason for hiding this comment

jeremyevans Jul 2, 2024

Choose a reason for hiding this comment

ioquatix left a comment

Choose a reason for hiding this comment

ioquatix Jul 2, 2024 •

edited

Loading