GO-2025-4086: Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode in github.com/TecharoHQ/anubis

internal

package

v1.17.0-beta1 Latest Latest Go to latest Published: Apr 25, 2025 License: MIT Imports: 12 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/TecharoHQ/anubis

Links

Documentation ¶

Index ¶

Variables
func InitSlog(level string)
func NoBrowsing(next http.Handler) http.Handler
func NoStoreCache(next http.Handler) http.Handler
func RemoteXRealIP(useRemoteAddress bool, bindNetwork string, next http.Handler) http.Handler
func SHA256sum(text string) string
func UnchangingCache(next http.Handler) http.Handler
func XForwardedForToXRealIP(next http.Handler) http.Handler
func XForwardedForUpdate(next http.Handler) http.Handler
type XFFComputePreferences

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	ErrCantSplitHostParse = errors.New("internal: unable to net.SplitHostParse")
	ErrCantParseRemoteIP  = errors.New("internal: unable to parse remote IP")
)

View Source

var CGNat = netip.MustParsePrefix("100.64.0.0/10")

Functions ¶

func InitSlog ¶

func InitSlog(level string)

func NoBrowsing ¶ added in v1.16.0

func NoBrowsing(next http.Handler) http.Handler

NoBrowsing prevents directory browsing by returning a 404 for any request that ends with a "/".

func NoStoreCache ¶ added in v1.16.0

func NoStoreCache(next http.Handler) http.Handler

NoStoreCache sets the Cache-Control header to no-store for the response.

func RemoteXRealIP ¶ added in v1.16.0

func RemoteXRealIP(useRemoteAddress bool, bindNetwork string, next http.Handler) http.Handler

RemoteXRealIP sets the X-Real-Ip header to the request's real IP if the setting is enabled by the user.

func SHA256sum ¶ added in v1.15.0

func SHA256sum(text string) string

func UnchangingCache ¶

func UnchangingCache(next http.Handler) http.Handler

UnchangingCache sets the Cache-Control header to cache a response for 1 year if and only if the application is compiled in "release" mode by Docker.

func XForwardedForToXRealIP ¶ added in v1.14.1

func XForwardedForToXRealIP(next http.Handler) http.Handler

XForwardedForToXRealIP sets the X-Real-Ip header based on the contents of the X-Forwarded-For header.

func XForwardedForUpdate ¶ added in v1.17.0

func XForwardedForUpdate(next http.Handler) http.Handler

XForwardedForUpdate sets or updates the X-Forwarded-For header, adding the known remote address to an existing chain if present

Types ¶

type XFFComputePreferences ¶ added in v1.17.0

type XFFComputePreferences struct {
	StripPrivate  bool
	StripLoopback bool
	StripCGNAT    bool
	StripLLU      bool
	Flatten       bool
}

TODO: move into config

Source Files ¶

View all Source files

Directories ¶

Path	Synopsis
dnsbl
ogtags

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL