medlogic
/
olivetin
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security: Use quoted values for origin, URL, and force quoting.

This commit is contained in:
jamesread 2022-04-05 12:19:24 +01:00
parent 76971603b4
commit ebd1c4e938
3 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
cmd/OliveTin/main.go
View File

@ -22,6 +22,11 @@ var (
) )
func init() { func init() {
log.SetFormatter(&log.TextFormatter{
ForceQuote: true,
DisableTimestamp: true,
})
log.WithFields(log.Fields{ log.WithFields(log.Fields{
"version": version, "version": version,
"commit": commit, "commit": commit,

2
internal/cors/cors.go
View File

@ -13,7 +13,7 @@ import (
func AllowCors(h http.Handler) http.Handler { func AllowCors(h http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if origin := r.Header.Get("Origin"); origin != "" { if origin := r.Header.Get("Origin"); origin != "" {
log.Debugf("Adding CORS header origin: %v", origin) log.Debugf("Adding CORS header origin: %q", origin)
w.Header().Set("Access-Control-Allow-Origin", origin) w.Header().Set("Access-Control-Allow-Origin", origin)
} }

4
internal/httpservers/singleFrontend.go
View File

@ -32,12 +32,12 @@ func StartSingleHTTPFrontend(cfg *config.Config) {
mux := http.NewServeMux() mux := http.NewServeMux()
mux.HandleFunc("/api/", func(w http.ResponseWriter, r *http.Request) { mux.HandleFunc("/api/", func(w http.ResponseWriter, r *http.Request) {
log.Debugf("api req: %v", r.URL) log.Debugf("api req: %q", r.URL)
apiProxy.ServeHTTP(w, r) apiProxy.ServeHTTP(w, r)
}) })
mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
log.Debugf("ui req: %v", r.URL) log.Debugf("ui req: %q", r.URL)
webuiProxy.ServeHTTP(w, r) webuiProxy.ServeHTTP(w, r)
}) })