go-pkgz / rest / 32197043514

97%

push

github

Fix verified findings in middlewares and helpers (#49)

* fix: serve metrics unrestricted when no ips defined

Previously, Metrics() without arguments passed an empty list to matchSourceIP,
which returns false for every request, so the middleware answered 403 to all
callers instead of serving expvar as documented.

* fix: re-panic http.ErrAbortHandler in Recoverer

Previously, the sentinel was caught like any other panic and turned into a 500,
so net/http never learned it had to abort the response and close the
connection. Only the stack trace was suppressed for it.

* fix: encode json before committing the status in EncodeJSON

Previously, the status was written before encoding started, so a value that
fails to marshal left the caller with an error after a 2xx was already on the
wire and no way to replace it with a 500. Encoding into a buffer first makes a
returned error mean nothing was written.

* fix: close file handles opened while probing directories

Previously, customFS.Open discarded the handle used to probe for index.html and
returned without closing the directory on the Stat and missing-index error
paths. http.FileServer closes only the file it receives, so each directory
request leaked a descriptor until the finalizer ran.

* fix: add Vary Accept-Encoding to gzip responses

The middleware changes the representation based on Accept-Encoding but never
told caches about it, so a shared cache could hand gzip bytes to a client that
asked for none.

* fix: refuse requests whose body can't be inspected in BlackWords

Previously, a failing io.ReadAll skipped the word check entirely and passed a
partially consumed body to the handler, so a truncated or aborted request went
through unchecked. Such a request now gets a 400 and never reaches the handler.

* chore: update modules, apply go fix

x/crypto stays at v0.48.0, the last release that still builds with the go 1.24.0
declared in go.mod.

* docs: describe the Metrics, Recoverer, Gzip, BlackWords ... (continued)

43 of 43 new or added lines in 6 files covered. (100.0%)

1522 of 1562 relevant lines covered (97.44%)

48.73 hits per line