go-pkgz / auth
85%

DEFAULT BRANCH: master
Repo Added
Files 25
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH master
branch: master
CHANGE BRANCH
x

coverage: 85.425% (+0.03%) from 85.395%
26203179848

push

github

umputun 
docs: package-wide comment sweep (non-security)

Pre-existing comment drift in files unrelated to the recent security fix —
unrelated docstrings that misled, said the wrong thing, or were copy-paste
leftovers. Mirrored across v1 and v2.

The security-fix docstring fixes (avatar/avatar.go security comments and
auth.go withSecurityHeaders) live in PR #291 and are intentionally NOT
included here so the two PRs stay independent.

Findings:

  * avatar/gridfs.go — ID doc claimed MD5 sourced from gridfs; metadata.hash
    is the sha1 written at Put time.
  * avatar/bolt.go, avatar/gridfs.go — Put docs and BoltDB type doc claimed
    these layers "resize" the image; they only copy bytes. Resize happens
    in Proxy.resize upstream.
  * avatar/store.go — Migrate doc didn't mention that per-avatar Get/Put/Close
    errors are logged and skipped, and that the returned count is "ids
    attempted", not "ids stored".
  * provider/oauth1.go — initOauth1Handler doc and DEBUG log both said
    "oauth2".
  * provider/service.go — Service.Handler doc said "returns auth routes";
    it dispatches login/callback/logout.
  * provider/telegram.go — processUpdates claimed to return an offset (no
    return value); checkToken doc described an "address or empty string"
    return shape but the signature is (*token.User, error).
  * provider/verify.go — Sender interface doc locked the contract to "send
    emails", contradicting the broader "email, IM, or anything else" on
    VerifyHandler. AuthHandler comment was copy-pasted from direct.
  * provider/dev_provider.go — NewDev doc said "for admin user"; just makes
    the dev oauth2 provider.
  * middleware/user_updater.go — UserUpdFunc adapter doc said result "is a
    Handler"; implements UserUpdater.
  * logger/interface.go — Func adapter doc said "Logf calls f(id)"; actually
    calls f(format, args...).
  * token/jwt.go — SendJWTHeader option doc said "instead of cookie"; Set
    sends header AND cookie. Set doc referenc... (continued)

3 of 3 new or added lines in 3 files covered. (100.0%)

3042 of 3561 relevant lines covered (85.43%)

8.3 hits per line

Relevant lines Covered
3561 RELEVANT LINES 3042 COVERED LINES
8.3 HITS PER LINE
Source Files on master

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
26203179848 master docs: package-wide comment sweep (non-security) Pre-existing comment drift in files unrelated to the recent security fix — unrelated docstrings that misled, said the wrong thing, or were copy-paste leftovers. Mirrored across v1 and v2. The secur... push umputun github
85.43
26203178078 master docs(auth, avatar): fix misleading and stale docstrings around the security fix Sweep over the docstrings touched (or adjacent to) PR #290's security work, prompted by Copilot's post-merge review of withSecurityHeaders and an adversarial pass fro... push umputun github
85.43
26203179844 master docs: package-wide comment sweep (non-security) Pre-existing comment drift in files unrelated to the recent security fix — unrelated docstrings that misled, said the wrong thing, or were copy-paste leftovers. Mirrored across v1 and v2. The secur... push umputun github
85.39
26203178077 master docs(auth, avatar): fix misleading and stale docstrings around the security fix Sweep over the docstrings touched (or adjacent to) PR #290's security work, prompted by Copilot's post-merge review of withSecurityHeaders and an adversarial pass fro... push umputun github
85.39
26198058385 master fix(avatar): prevent stored XSS via content-type spoofing (#290) * fix(avatar): reject non-image content to prevent stored XSS via content-type spoofing The avatar proxy stored whatever bytes upstream returned at u.Picture and served them back w... push web-flow github
85.39
26198058340 master fix(avatar): prevent stored XSS via content-type spoofing (#290) * fix(avatar): reject non-image content to prevent stored XSS via content-type spoofing The avatar proxy stored whatever bytes upstream returned at u.Picture and served them back w... push web-flow github
85.43
25620289937 master fix(verify): close service-level typed-nil store + adapter-author guidance Followups to #281 (verify replay protection) raised on the post-merge review. None blocking, all small. 1. Service-level typed-nil VerifConfirmationStoreFunc guard. The ... push umputun github
85.32
25620289928 master fix(verify): close service-level typed-nil store + adapter-author guidance Followups to #281 (verify replay protection) raised on the post-merge review. None blocking, all small. 1. Service-level typed-nil VerifConfirmationStoreFunc guard. The ... push umputun github
85.29
25606477506 master fix(verify): one-shot consumption of email confirmation tokens The email confirmation JWT issued by VerifyHandler.sendConfirmation was only protected by its 30-minute expiry: any party who could read the confirmation link (forwarded email, mail-g... push umputun github
85.2
25606477509 master fix(verify): one-shot consumption of email confirmation tokens The email confirmation JWT issued by VerifyHandler.sendConfirmation was only protected by its 30-minute expiry: any party who could read the confirmation link (forwarded email, mail-g... push umputun github
85.23
See All Builds (1078)