GO-2025-4086: Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode in github.com/TecharoHQ/anubis

internal

package

v1.18.0 Latest Latest Go to latest Published: May 9, 2025 License: MIT Imports: 13 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/TecharoHQ/anubis

Links

Documentation ¶

Index ¶

Variables
func GetFilteredHTTPLogger() *log.Logger
func GetRequestLogger(r *http.Request) *slog.Logger
func InitSlog(level string)
func NoBrowsing(next http.Handler) http.Handler
func NoStoreCache(next http.Handler) http.Handler
func RemoteXRealIP(useRemoteAddress bool, bindNetwork string, next http.Handler) http.Handler
func SHA256sum(text string) string
func UnchangingCache(next http.Handler) http.Handler
func XForwardedForToXRealIP(next http.Handler) http.Handler
func XForwardedForUpdate(next http.Handler) http.Handler
type ErrorLogFilter
- func (elf *ErrorLogFilter) Write(p []byte) (n int, err error)
type XFFComputePreferences

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	ErrCantSplitHostParse = errors.New("internal: unable to net.SplitHostParse")
	ErrCantParseRemoteIP  = errors.New("internal: unable to parse remote IP")
)

View Source

var CGNat = netip.MustParsePrefix("100.64.0.0/10")

Functions ¶

func GetFilteredHTTPLogger ¶ added in v1.18.0

func GetFilteredHTTPLogger() *log.Logger

func GetRequestLogger ¶ added in v1.17.0

func GetRequestLogger(r *http.Request) *slog.Logger

func InitSlog ¶

func InitSlog(level string)

func NoBrowsing ¶ added in v1.16.0

func NoBrowsing(next http.Handler) http.Handler

NoBrowsing prevents directory browsing by returning a 404 for any request that ends with a "/".

func NoStoreCache ¶ added in v1.16.0

func NoStoreCache(next http.Handler) http.Handler

NoStoreCache sets the Cache-Control header to no-store for the response.

func RemoteXRealIP ¶ added in v1.16.0

func RemoteXRealIP(useRemoteAddress bool, bindNetwork string, next http.Handler) http.Handler

RemoteXRealIP sets the X-Real-Ip header to the request's real IP if the setting is enabled by the user.

func SHA256sum ¶ added in v1.15.0

func SHA256sum(text string) string

func UnchangingCache ¶

func UnchangingCache(next http.Handler) http.Handler

UnchangingCache sets the Cache-Control header to cache a response for 1 year if and only if the application is compiled in "release" mode by Docker.

func XForwardedForToXRealIP ¶ added in v1.14.1

func XForwardedForToXRealIP(next http.Handler) http.Handler

XForwardedForToXRealIP sets the X-Real-Ip header based on the contents of the X-Forwarded-For header.

func XForwardedForUpdate ¶ added in v1.17.0

func XForwardedForUpdate(next http.Handler) http.Handler

XForwardedForUpdate sets or updates the X-Forwarded-For header, adding the known remote address to an existing chain if present

Types ¶

type ErrorLogFilter ¶ added in v1.18.0

type ErrorLogFilter struct {
	Unwrap *log.Logger
}

ErrorLogFilter is used to suppress "context canceled" logs from the http server when a request is canceled (e.g., when a client disconnects).

func (*ErrorLogFilter) Write ¶ added in v1.18.0

func (elf *ErrorLogFilter) Write(p []byte) (n int, err error)

type XFFComputePreferences ¶ added in v1.17.0

type XFFComputePreferences struct {
	StripPrivate  bool
	StripLoopback bool
	StripCGNAT    bool
	StripLLU      bool
	Flatten       bool
}

TODO: move into config

Source Files ¶

View all Source files

Directories ¶

Path	Synopsis
dnsbl
ogtags

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL