umputun / reproxy / 41177170951

81%

Build Type

push

github

Committed by web-flow

Commit Message

fix: reject path spellings that skip route policies, bump go 1.27 (#269)

* chore: add revmux review profile

the profile tells revmux reviewers what reproxy is, which failures matter
(wrong routing, request-path security, response corruption) and which
conventions are deliberate, so local reviews use reproxy's bar instead of a
generic one.

* fix: reject dot and empty path segments before route matching

route matching preserved dot segments and repeated slashes, while an upstream
may normalize them. With a protected ^/api/private/ route next to
a public ^/api/ one, /api/public/../private/x, its %2e%2e%2f form,
/api//private/x and /api/%2fprivate/x all matched the public route and
returned the protected resource without credentials. Now matchHandler answers
400 for a decoded path with a dot, double-dot or empty segment, a single
trailing slash excepted.

* chore: bump go to 1.27 and update all dependencies

go.mod, the CI workflows and both Dockerfiles move to Go 1.27, and module
dependencies are updated in both the main module and the plugin example.
golang.org/x/crypto goes from v0.51.0 to v0.58.0 to address the reported
Dependabot advisories; those were all in x/crypto/ssh, which reproxy does not
vendor. Two literals are rewritten for the Go 1.27 modernize check.

* ci: update actions and move goreleaser to v2

actions/checkout and actions/setup-go go to v7, and the golangci-lint pin to
v2.15.0. The release workflow runs goreleaser v2, so .goreleaser.yml gets
version 2 and the formats list for the Windows archive. The Homebrew formula
stays on brews, which v2 still supports as deprecated.

* fix: reject path-parameter and backslash dot segments

servlet-style upstreams strip ;params from a segment and some treat a backslash as a slash, so /api/public/..;/private/x, /api/;/private/x and /api/public/..%5cprivate/x passed the segment check and still reached a resource behind another route. The check now splits on backslashes too and judges each segme... (continued)

Coverage Stats

21 of 21 new or added lines in 2 files covered. (100.0%)

1 existing line in 1 file now uncovered.

2607 of 3222 relevant lines covered (80.91%)

70.07 hits per line