- ``multipart/form-data`` requests are now limited to 100 parts by default, to prevent a
denial-of-service attack via very large requests with many parts. This limit is configurable
via `tornado.httputil.ParseMultipartConfig`. Multipart parsing can also be disabled completely
- if not required for the application. Thanks to [0x-Apollyon](https://github.com/0x-Apollyon) and
- [bekkaze](https://github.com/bekkaze) for reporting this issue.
+ if not required for the application. Thanks to `0x-Apollyon <https://github.com/0x-Apollyon>`_ and
+ `bekkaze <https://github.com/bekkaze>`_ for reporting this issue.
- The ``domain``, ``path``, and ``samesite`` arguments to `.RequestHandler.set_cookie` are now
validated for illegal characters, which could be abused to inject other attributes on the cookie.
Thanks to Dhiral Vyas (Praetorian) for reporting this issue.
- Carriage return characters are no longer accepted in ``multipart/form-data`` headers. Thanks to
- [sergeykochanov](https://github.com/sergeykochanov) for reporting this issue.
\ No newline at end of file
+ `sergeykochanov <https://github.com/sergeykochanov>`_ for reporting this issue.