GO-2025-4086: Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode in github.com/TecharoHQ/anubis

internal

package

v1.22.0-pre1 Latest Latest Go to latest Published: Aug 24, 2025 License: MIT Imports: 22 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/TecharoHQ/anubis

Links

Documentation ¶

Index ¶

Variables
func FastHash(text string) string
func GetFilteredHTTPLogger() *log.Logger
func GetHealth(svc string) (healthv1.HealthCheckResponse_ServingStatus, bool)
func GetRequestLogger(base *slog.Logger, r *http.Request) *slog.Logger
func GzipMiddleware(level int, next http.Handler) http.Handler
func InitSlog(level string)
func JA4H(next http.Handler) http.Handler
func NoBrowsing(next http.Handler) http.Handler
func NoStoreCache(next http.Handler) http.Handler
func RemoteXRealIP(useRemoteAddress bool, bindNetwork string, next http.Handler) http.Handler
func SHA256sum(text string) string
func SetHealth(svc string, status healthv1.HealthCheckResponse_ServingStatus)
func UnbreakDocker()
func UnchangingCache(next http.Handler) http.Handler
func XForwardedForToXRealIP(next http.Handler) http.Handler
func XForwardedForUpdate(stripPrivate bool, next http.Handler) http.Handler
type ErrorLogFilter
- func (elf *ErrorLogFilter) Write(p []byte) (n int, err error)
type XFFComputePreferences

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	ErrCantSplitHostParse = errors.New("internal: unable to net.SplitHostParse")
	ErrCantParseRemoteIP  = errors.New("internal: unable to parse remote IP")
)

View Source

var CGNat = netip.MustParsePrefix("100.64.0.0/10")

View Source

var HealthSrv = health.NewServer()

Functions ¶

func FastHash ¶ added in v1.20.0

func FastHash(text string) string

FastHash is a high-performance non-cryptographic hash function suitable for internal caching, policy rule identification, and other performance-critical use cases where cryptographic security is not required.

func GetFilteredHTTPLogger ¶ added in v1.18.0

func GetFilteredHTTPLogger() *log.Logger

func GetHealth ¶ added in v1.21.0

func GetHealth(svc string) (healthv1.HealthCheckResponse_ServingStatus, bool)

func GetRequestLogger ¶ added in v1.17.0

func GetRequestLogger(base *slog.Logger, r *http.Request) *slog.Logger

func GzipMiddleware ¶ added in v1.19.0

func GzipMiddleware(level int, next http.Handler) http.Handler

func InitSlog ¶

func InitSlog(level string)

func JA4H ¶ added in v1.21.0

func JA4H(next http.Handler) http.Handler

func NoBrowsing ¶ added in v1.16.0

func NoBrowsing(next http.Handler) http.Handler

NoBrowsing prevents directory browsing by returning a 404 for any request that ends with a "/".

func NoStoreCache ¶ added in v1.16.0

func NoStoreCache(next http.Handler) http.Handler

NoStoreCache sets the Cache-Control header to no-store for the response.

func RemoteXRealIP ¶ added in v1.16.0

func RemoteXRealIP(useRemoteAddress bool, bindNetwork string, next http.Handler) http.Handler

RemoteXRealIP sets the X-Real-Ip header to the request's real IP if the setting is enabled by the user.

func SHA256sum ¶ added in v1.15.0

func SHA256sum(text string) string

SHA256sum computes a cryptographic hash. Still used for proof-of-work challenges where we need the security properties of a cryptographic hash function.

func SetHealth ¶ added in v1.21.0

func SetHealth(svc string, status healthv1.HealthCheckResponse_ServingStatus)

func UnbreakDocker ¶ added in v1.21.0

func UnbreakDocker()

func UnchangingCache ¶

func UnchangingCache(next http.Handler) http.Handler

UnchangingCache sets the Cache-Control header to cache a response for 1 year if and only if the application is compiled in "release" mode by Docker.

func XForwardedForToXRealIP ¶ added in v1.14.1

func XForwardedForToXRealIP(next http.Handler) http.Handler

XForwardedForToXRealIP sets the X-Real-Ip header based on the contents of the X-Forwarded-For header.

func XForwardedForUpdate ¶ added in v1.17.0

func XForwardedForUpdate(stripPrivate bool, next http.Handler) http.Handler

XForwardedForUpdate sets or updates the X-Forwarded-For header, adding the known remote address to an existing chain if present

Types ¶

type ErrorLogFilter ¶ added in v1.18.0

type ErrorLogFilter struct {
	Unwrap *log.Logger
}

ErrorLogFilter is used to suppress "context canceled" logs from the http server when a request is canceled (e.g., when a client disconnects).

func (*ErrorLogFilter) Write ¶ added in v1.18.0

func (elf *ErrorLogFilter) Write(p []byte) (n int, err error)

type XFFComputePreferences ¶ added in v1.17.0

type XFFComputePreferences struct {
	StripPrivate  bool
	StripLoopback bool
	StripCGNAT    bool
	StripLLU      bool
	Flatten       bool
}

TODO: move into config

Source Files ¶

View all Source files

Directories ¶

Path	Synopsis
dnsbl
ogtags

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL