backends

May 20, 2016 GO-2024-3108 +2 more

  GO-2024-3108: Hoverfly allows an arbitrary file read in the `/api/v2/simulation` endpoint (`GHSL-2023-274`) in github.com/SpectoLabs/hoverfly

  GO-2025-3944: Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly

  GO-2025-3945: WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled in github.com/SpectoLabs/hoverfly

May 9, 2016 GO-2024-3108 +2 more

  GO-2024-3108: Hoverfly allows an arbitrary file read in the `/api/v2/simulation` endpoint (`GHSL-2023-274`) in github.com/SpectoLabs/hoverfly

  GO-2025-3944: Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly

  GO-2025-3945: WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled in github.com/SpectoLabs/hoverfly

Changes in this version

+ type Authentication interface

+ AddUser func(username, password string, admin bool) (err error)

+ GetAllUsers func() (users []User, err error)

+ GetUser func(username string) (user *User, err error)

+ InvalidateToken func(token string) (err error)

+ IsTokenBlacklisted func(token string) (blacklisted bool, err error)

+ type CacheAuthBackend struct

+ TokenCache cache.Cache

+ func NewCacheBasedAuthBackend(tokenCache, userCache cache.Cache) *CacheAuthBackend

+ func (b *CacheAuthBackend) AddUser(username, password string, admin bool) error

+ func (b *CacheAuthBackend) GetAllUsers() (users []User, err error)

+ func (b *CacheAuthBackend) GetUser(username string) (user *User, err error)

+ func (b *CacheAuthBackend) InvalidateToken(token string) error

+ func (b *CacheAuthBackend) IsTokenBlacklisted(token string) (bool, error)

Apr 1, 2016 GO-2024-3108 +2 more

  GO-2024-3108: Hoverfly allows an arbitrary file read in the `/api/v2/simulation` endpoint (`GHSL-2023-274`) in github.com/SpectoLabs/hoverfly

  GO-2025-3944: Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly

  GO-2025-3945: WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled in github.com/SpectoLabs/hoverfly

Changes in this version

type AuthBackend

+ TokenCache cache.Cache

+ func NewAuthBackend(tokenCache, userCache cache.Cache) AuthBackend

Mar 21, 2016 GO-2024-3108 +2 more

  GO-2024-3108: Hoverfly allows an arbitrary file read in the `/api/v2/simulation` endpoint (`GHSL-2023-274`) in github.com/SpectoLabs/hoverfly

  GO-2025-3944: Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly

  GO-2025-3945: WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled in github.com/SpectoLabs/hoverfly

Mar 10, 2016 GO-2024-3108 +2 more

  GO-2024-3108: Hoverfly allows an arbitrary file read in the `/api/v2/simulation` endpoint (`GHSL-2023-274`) in github.com/SpectoLabs/hoverfly

  GO-2025-3944: Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly

  GO-2025-3945: WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled in github.com/SpectoLabs/hoverfly

Mar 7, 2016 GO-2024-3108 +2 more

  GO-2024-3108: Hoverfly allows an arbitrary file read in the `/api/v2/simulation` endpoint (`GHSL-2023-274`) in github.com/SpectoLabs/hoverfly

  GO-2025-3944: Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly

  GO-2025-3945: WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled in github.com/SpectoLabs/hoverfly

Mar 4, 2016 GO-2024-3108 +2 more

  GO-2024-3108: Hoverfly allows an arbitrary file read in the `/api/v2/simulation` endpoint (`GHSL-2023-274`) in github.com/SpectoLabs/hoverfly

  GO-2025-3944: Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly

  GO-2025-3945: WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled in github.com/SpectoLabs/hoverfly

Changes in this version

+ const TokenBucketName

+ const UserBucketName

+ type AuthBackend interface

+ AddUser func(username, password []byte, admin bool) error

+ DeleteUser func(username []byte) error

+ GetAllUsers func() ([]User, error)

+ GetUser func(username []byte) (*User, error)

+ GetValue func(key []byte) ([]byte, error)

+ SetValue func(key, value []byte) error

+ type BoltAuth struct

+ DS *bolt.DB

+ TokenBucket []byte

+ UserBucket []byte

+ func NewBoltDBAuthBackend(db *bolt.DB, tokenBucket, userBucket []byte) *BoltAuth

+ func (b *BoltAuth) AddUser(username, password []byte, admin bool) error

+ func (b *BoltAuth) DeleteUser(username []byte) error

+ func (b *BoltAuth) GetAllUsers() (users []User, err error)

+ func (b *BoltAuth) GetUser(username []byte) (user *User, err error)

+ func (b *BoltAuth) GetValue(key []byte) (value []byte, err error)

+ func (b *BoltAuth) SetValue(key, value []byte) error

+ type User struct

+ IsAdmin bool

+ Password string

+ UUID string

+ Username string

+ func DecodeUser(user []byte) (*User, error)

+ func (u *User) Encode() ([]byte, error)