zalando / skipper / 39268068193

81%

Build Type

push

github

Committed by web-flow

Commit Message

Feature: expose priority routes to binary users (#4347)

PriorityRoutes are a very old skipper library feature, that could be
useful for binary users, too.
PriorityRoutes are matched before the normal route lookup happens and if
there is a result then the priority route is used.
This is a perfect match for a WAF kind of capability. For example we can
deny requests that contain `../` because these are commonly used in path
traversal attacks.
We got some advisories about possible path traversal in combination with
backends that do a different evaluation of path normalization in the
routing than us. To allow people a cheap mitigation of all these kind of
attacks, we allow to set inline routes as the PriorityRoutes via:
 ```eskip
-priority-routes='prio: UrlRawPathRegexp(/[.][.][/]/) -> status(401) ->
<shunt>;'
```
and routes file priority routes via: `-priority-routes-file`

---------

Signed-off-by: Sandor Szücs <sandor.szuecs@zalando.de>

Coverage Stats

33 of 62 new or added lines in 4 files covered. (53.23%)

5 existing lines in 2 files now uncovered.

27686 of 34170 relevant lines covered (81.02%)

72061.89 hits per line