echo

Oct 30, 2026 GO-2026-6872 +1 more

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

Oct 23, 2026 GO-2026-6872 +1 more

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

Oct 22, 2026 GO-2026-6872 +1 more

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

Sep 27, 2026 GO-2026-6838 +5 more

  GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

Changes in this version

+ var ErrInvalidJSONPCallback = errors.New("invalid JSONP callback")

type Echo

+ SchemeExtractor SchemeExtractor

+ type SchemeExtractor func(*http.Request) string

+ func ExtractSchemeDirect() SchemeExtractor

+ func ExtractSchemeFromHeaders(options ...TrustOption) SchemeExtractor

+ func LegacySchemeExtractor() SchemeExtractor

Jun 15, 2026 GO-2026-6838 +11 more

  GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

Changes in this version

type Echo

+ EnablePathUnescapingStaticFiles bool

Jun 14, 2026 GO-2026-6838 +11 more

  GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

May 1, 2026 GO-2026-6293 +13 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Feb 22, 2026 GO-2026-6293 +14 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Jan 1, 2026 GO-2026-6293 +14 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

+ const HeaderSecFetchSite

+ const TimeLayoutUnixTime

+ const TimeLayoutUnixTimeMilli

+ const TimeLayoutUnixTimeNano

+ var ErrInvalidKeyType = errors.New("invalid key type")

+ var ErrNonExistentKey = errors.New("non existent key")

+ func ContextGetOr[T any](c Context, key string, defaultValue T) (T, error)

+ func ContextGet[T any](c Context, key string) (T, error)

+ func FormParamOr[T any](c Context, key string, defaultValue T, opts ...any) (T, error)

+ func FormParam[T any](c Context, key string, opts ...any) (T, error)

+ func FormParamsOr[T any](c Context, key string, defaultValue []T, opts ...any) ([]T, error)

+ func FormParams[T any](c Context, key string, opts ...any) ([]T, error)

+ func ParseValueOr[T any](value string, defaultValue T, opts ...any) (T, error)

+ func ParseValue[T any](value string, opts ...any) (T, error)

+ func ParseValuesOr[T any](values []string, defaultValue []T, opts ...any) ([]T, error)

+ func ParseValues[T any](values []string, opts ...any) ([]T, error)

+ func PathParamOr[T any](c Context, paramName string, defaultValue T, opts ...any) (T, error)

+ func PathParam[T any](c Context, paramName string, opts ...any) (T, error)

+ func QueryParamOr[T any](c Context, key string, defaultValue T, opts ...any) (T, error)

+ func QueryParam[T any](c Context, key string, opts ...any) (T, error)

+ func QueryParamsOr[T any](c Context, key string, defaultValue []T, opts ...any) ([]T, error)

+ func QueryParams[T any](c Context, key string, opts ...any) ([]T, error)

+ type TimeLayout string

+ type TimeOpts struct

+ Layout TimeLayout

+ ParseInLocation *time.Location

+ ToInLocation *time.Location

Dec 11, 2025 GO-2026-6293 +13 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

May 22, 2025 GO-2026-6293 +13 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Dec 19, 2024 GO-2026-6293 +13 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Dec 12, 2024 GO-2026-6293 +13 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Dec 11, 2024 GO-2026-6293 +13 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Dec 4, 2024 GO-2026-6293 +13 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

+ type TemplateRenderer struct

+ Template interface{ ... }

+ func (t *TemplateRenderer) Render(w io.Writer, name string, data interface{}, c Context) error

Apr 15, 2024 GO-2026-6293 +13 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Dec 20, 2023 GO-2026-6293 +13 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Nov 7, 2023 GO-2026-6293 +13 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Oct 11, 2023 GO-2026-6293 +13 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Jul 16, 2023 GO-2026-6293 +13 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Jul 14, 2023 GO-2026-6293 +13 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

type Response

+ func (r *Response) Unwrap() http.ResponseWriter

Feb 21, 2023 GO-2026-6293 +13 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

+ var ErrConflict = NewHTTPError(http.StatusConflict)

+ var ErrExpectationFailed = NewHTTPError(http.StatusExpectationFailed)

+ var ErrFailedDependency = NewHTTPError(http.StatusFailedDependency)

+ var ErrGatewayTimeout = NewHTTPError(http.StatusGatewayTimeout)

+ var ErrGone = NewHTTPError(http.StatusGone)

+ var ErrHTTPVersionNotSupported = NewHTTPError(http.StatusHTTPVersionNotSupported)

+ var ErrInsufficientStorage = NewHTTPError(http.StatusInsufficientStorage)

+ var ErrLengthRequired = NewHTTPError(http.StatusLengthRequired)

+ var ErrLocked = NewHTTPError(http.StatusLocked)

+ var ErrLoopDetected = NewHTTPError(http.StatusLoopDetected)

+ var ErrMisdirectedRequest = NewHTTPError(http.StatusMisdirectedRequest)

+ var ErrNetworkAuthenticationRequired = NewHTTPError(http.StatusNetworkAuthenticationRequired)

+ var ErrNotAcceptable = NewHTTPError(http.StatusNotAcceptable)

+ var ErrNotExtended = NewHTTPError(http.StatusNotExtended)

+ var ErrNotImplemented = NewHTTPError(http.StatusNotImplemented)

+ var ErrPaymentRequired = NewHTTPError(http.StatusPaymentRequired)

+ var ErrPreconditionFailed = NewHTTPError(http.StatusPreconditionFailed)

+ var ErrPreconditionRequired = NewHTTPError(http.StatusPreconditionRequired)

+ var ErrProxyAuthRequired = NewHTTPError(http.StatusProxyAuthRequired)

+ var ErrRequestHeaderFieldsTooLarge = NewHTTPError(http.StatusRequestHeaderFieldsTooLarge)

+ var ErrRequestURITooLong = NewHTTPError(http.StatusRequestURITooLong)

+ var ErrRequestedRangeNotSatisfiable = NewHTTPError(http.StatusRequestedRangeNotSatisfiable)

+ var ErrTeapot = NewHTTPError(http.StatusTeapot)

+ var ErrTooEarly = NewHTTPError(http.StatusTooEarly)

+ var ErrUnavailableForLegalReasons = NewHTTPError(http.StatusUnavailableForLegalReasons)

+ var ErrUnprocessableEntity = NewHTTPError(http.StatusUnprocessableEntity)

+ var ErrUpgradeRequired = NewHTTPError(http.StatusUpgradeRequired)

+ var ErrVariantAlsoNegotiates = NewHTTPError(http.StatusVariantAlsoNegotiates)

Feb 19, 2023 GO-2026-6293 +13 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Dec 27, 2022 GO-2026-6293 +13 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

type Echo

+ OnAddRouteHandler func(host string, route Route, handler HandlerFunc, middleware []MiddlewareFunc)

type HTTPError

+ func (he *HTTPError) WithInternal(err error) *HTTPError

type Router

+ func (r *Router) Reverse(name string, params ...interface{}) string

+ func (r *Router) Routes() []*Route

Oct 12, 2022 GO-2026-6293 +13 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Sep 4, 2022 GO-2026-6293 +13 more

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Aug 10, 2022 GO-2022-1031 +14 more

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

+ const RouteNotFound

type Echo

+ func (e *Echo) RouteNotFound(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

type Group

+ func (g *Group) RouteNotFound(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

type ValueBinder

+ func (b *ValueBinder) JSONUnmarshaler(sourceParam string, dest json.Unmarshaler) *ValueBinder

+ func (b *ValueBinder) MustJSONUnmarshaler(sourceParam string, dest json.Unmarshaler) *ValueBinder

+ func (b *ValueBinder) MustTextUnmarshaler(sourceParam string, dest encoding.TextUnmarshaler) *ValueBinder

+ func (b *ValueBinder) MustUnixTimeMilli(sourceParam string, dest *time.Time) *ValueBinder

+ func (b *ValueBinder) TextUnmarshaler(sourceParam string, dest encoding.TextUnmarshaler) *ValueBinder

+ func (b *ValueBinder) UnixTimeMilli(sourceParam string, dest *time.Time) *ValueBinder

Mar 16, 2022 GO-2022-1031 +14 more

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Mar 13, 2022 GO-2022-1031 +14 more

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Mar 2, 2022 GO-2022-1031 +14 more

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

+ const ContextKeyHeaderAllow

+ const HeaderCacheControl

+ const HeaderConnection

+ const HeaderRetryAfter

+ func MustSubFS(currentFs fs.FS, fsRoot string) fs.FS

type Echo

+ func (e *Echo) FileFS(path, file string, filesystem fs.FS, m ...MiddlewareFunc) *Route

+ func (e *Echo) StaticFS(pathPrefix string, filesystem fs.FS) *Route

type Group

+ func (g *Group) FileFS(path, file string, filesystem fs.FS, m ...MiddlewareFunc) *Route

+ func (g *Group) StaticFS(pathPrefix string, filesystem fs.FS)

type HandlerFunc

+ func StaticDirectoryHandler(fileSystem fs.FS, disablePathUnescaping bool) HandlerFunc

+ func StaticFileHandler(file string, filesystem fs.FS) HandlerFunc

Jan 10, 2022 GO-2022-1031 +14 more

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Dec 17, 2021 GO-2022-1031 +14 more

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

+ const HeaderXCorrelationID

Sep 26, 2021 GO-2022-1031 +14 more

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Sep 20, 2021 GO-2022-1031 +14 more

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Aug 1, 2021 GO-2022-1031 +14 more

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Jul 12, 2021 GO-2022-1031 +14 more

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

type DefaultBinder

+ func (b *DefaultBinder) BindHeaders(c Context, i interface{}) error

+ type DefaultJSONSerializer struct

+ func (d DefaultJSONSerializer) Deserialize(c Context, i interface{}) error

+ func (d DefaultJSONSerializer) Serialize(c Context, i interface{}, indent string) error

type Echo

+ JSONSerializer JSONSerializer

+ type JSONSerializer interface

+ Deserialize func(c Context, i interface{}) error

+ Serialize func(c Context, i interface{}, indent string) error

May 8, 2021 GO-2022-1031 +14 more

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Apr 7, 2021 GO-2022-1031 +14 more

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Mar 8, 2021 GO-2022-1031 +14 more

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Feb 11, 2021 GO-2022-1031 +14 more

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

+ var ErrInvalidListenerNetwork = errors.New("invalid listener network")

+ func NewBindingError(sourceParam string, values []string, message interface{}, internalError error) error

+ type BindingError struct

+ Field string

+ Values []string

+ func (be *BindingError) Error() string

type DefaultBinder

+ func (b *DefaultBinder) BindBody(c Context, i interface{}) (err error)

+ func (b *DefaultBinder) BindPathParams(c Context, i interface{}) error

+ func (b *DefaultBinder) BindQueryParams(c Context, i interface{}) error

type Echo

+ ListenerNetwork string

+ func (e *Echo) ListenerAddr() net.Addr

+ func (e *Echo) TLSListenerAddr() net.Addr

+ type ValueBinder struct

+ ErrorFunc func(sourceParam string, values []string, message interface{}, internalError error) error

+ ValueFunc func(sourceParam string) string

+ ValuesFunc func(sourceParam string) []string

+ func FormFieldBinder(c Context) *ValueBinder

+ func PathParamsBinder(c Context) *ValueBinder

+ func QueryParamsBinder(c Context) *ValueBinder

+ func (b *ValueBinder) BindError() error

+ func (b *ValueBinder) BindErrors() []error

+ func (b *ValueBinder) BindUnmarshaler(sourceParam string, dest BindUnmarshaler) *ValueBinder

+ func (b *ValueBinder) BindWithDelimiter(sourceParam string, dest interface{}, delimiter string) *ValueBinder

+ func (b *ValueBinder) Bool(sourceParam string, dest *bool) *ValueBinder

+ func (b *ValueBinder) Bools(sourceParam string, dest *[]bool) *ValueBinder

+ func (b *ValueBinder) Byte(sourceParam string, dest *byte) *ValueBinder

+ func (b *ValueBinder) CustomFunc(sourceParam string, customFunc func(values []string) []error) *ValueBinder

+ func (b *ValueBinder) Duration(sourceParam string, dest *time.Duration) *ValueBinder

+ func (b *ValueBinder) Durations(sourceParam string, dest *[]time.Duration) *ValueBinder

+ func (b *ValueBinder) FailFast(value bool) *ValueBinder

+ func (b *ValueBinder) Float32(sourceParam string, dest *float32) *ValueBinder

+ func (b *ValueBinder) Float32s(sourceParam string, dest *[]float32) *ValueBinder

+ func (b *ValueBinder) Float64(sourceParam string, dest *float64) *ValueBinder

+ func (b *ValueBinder) Float64s(sourceParam string, dest *[]float64) *ValueBinder

+ func (b *ValueBinder) Int(sourceParam string, dest *int) *ValueBinder

+ func (b *ValueBinder) Int16(sourceParam string, dest *int16) *ValueBinder

+ func (b *ValueBinder) Int16s(sourceParam string, dest *[]int16) *ValueBinder

+ func (b *ValueBinder) Int32(sourceParam string, dest *int32) *ValueBinder

+ func (b *ValueBinder) Int32s(sourceParam string, dest *[]int32) *ValueBinder

+ func (b *ValueBinder) Int64(sourceParam string, dest *int64) *ValueBinder

+ func (b *ValueBinder) Int64s(sourceParam string, dest *[]int64) *ValueBinder

+ func (b *ValueBinder) Int8(sourceParam string, dest *int8) *ValueBinder

+ func (b *ValueBinder) Int8s(sourceParam string, dest *[]int8) *ValueBinder

+ func (b *ValueBinder) Ints(sourceParam string, dest *[]int) *ValueBinder

+ func (b *ValueBinder) MustBindUnmarshaler(sourceParam string, dest BindUnmarshaler) *ValueBinder

+ func (b *ValueBinder) MustBindWithDelimiter(sourceParam string, dest interface{}, delimiter string) *ValueBinder

+ func (b *ValueBinder) MustBool(sourceParam string, dest *bool) *ValueBinder

+ func (b *ValueBinder) MustBools(sourceParam string, dest *[]bool) *ValueBinder

+ func (b *ValueBinder) MustByte(sourceParam string, dest *byte) *ValueBinder

+ func (b *ValueBinder) MustCustomFunc(sourceParam string, customFunc func(values []string) []error) *ValueBinder

+ func (b *ValueBinder) MustDuration(sourceParam string, dest *time.Duration) *ValueBinder

+ func (b *ValueBinder) MustDurations(sourceParam string, dest *[]time.Duration) *ValueBinder

+ func (b *ValueBinder) MustFloat32(sourceParam string, dest *float32) *ValueBinder

+ func (b *ValueBinder) MustFloat32s(sourceParam string, dest *[]float32) *ValueBinder

+ func (b *ValueBinder) MustFloat64(sourceParam string, dest *float64) *ValueBinder

+ func (b *ValueBinder) MustFloat64s(sourceParam string, dest *[]float64) *ValueBinder

+ func (b *ValueBinder) MustInt(sourceParam string, dest *int) *ValueBinder

+ func (b *ValueBinder) MustInt16(sourceParam string, dest *int16) *ValueBinder

+ func (b *ValueBinder) MustInt16s(sourceParam string, dest *[]int16) *ValueBinder

+ func (b *ValueBinder) MustInt32(sourceParam string, dest *int32) *ValueBinder

+ func (b *ValueBinder) MustInt32s(sourceParam string, dest *[]int32) *ValueBinder

+ func (b *ValueBinder) MustInt64(sourceParam string, dest *int64) *ValueBinder

+ func (b *ValueBinder) MustInt64s(sourceParam string, dest *[]int64) *ValueBinder

+ func (b *ValueBinder) MustInt8(sourceParam string, dest *int8) *ValueBinder

+ func (b *ValueBinder) MustInt8s(sourceParam string, dest *[]int8) *ValueBinder

+ func (b *ValueBinder) MustInts(sourceParam string, dest *[]int) *ValueBinder

+ func (b *ValueBinder) MustString(sourceParam string, dest *string) *ValueBinder

+ func (b *ValueBinder) MustStrings(sourceParam string, dest *[]string) *ValueBinder

+ func (b *ValueBinder) MustTime(sourceParam string, dest *time.Time, layout string) *ValueBinder

+ func (b *ValueBinder) MustTimes(sourceParam string, dest *[]time.Time, layout string) *ValueBinder

+ func (b *ValueBinder) MustUint(sourceParam string, dest *uint) *ValueBinder

+ func (b *ValueBinder) MustUint16(sourceParam string, dest *uint16) *ValueBinder

+ func (b *ValueBinder) MustUint16s(sourceParam string, dest *[]uint16) *ValueBinder

+ func (b *ValueBinder) MustUint32(sourceParam string, dest *uint32) *ValueBinder

+ func (b *ValueBinder) MustUint32s(sourceParam string, dest *[]uint32) *ValueBinder

+ func (b *ValueBinder) MustUint64(sourceParam string, dest *uint64) *ValueBinder

+ func (b *ValueBinder) MustUint64s(sourceParam string, dest *[]uint64) *ValueBinder

+ func (b *ValueBinder) MustUint8(sourceParam string, dest *uint8) *ValueBinder

+ func (b *ValueBinder) MustUint8s(sourceParam string, dest *[]uint8) *ValueBinder

+ func (b *ValueBinder) MustUints(sourceParam string, dest *[]uint) *ValueBinder

+ func (b *ValueBinder) MustUnixTime(sourceParam string, dest *time.Time) *ValueBinder

+ func (b *ValueBinder) MustUnixTimeNano(sourceParam string, dest *time.Time) *ValueBinder

+ func (b *ValueBinder) String(sourceParam string, dest *string) *ValueBinder

+ func (b *ValueBinder) Strings(sourceParam string, dest *[]string) *ValueBinder

+ func (b *ValueBinder) Time(sourceParam string, dest *time.Time, layout string) *ValueBinder

+ func (b *ValueBinder) Times(sourceParam string, dest *[]time.Time, layout string) *ValueBinder

+ func (b *ValueBinder) Uint(sourceParam string, dest *uint) *ValueBinder

+ func (b *ValueBinder) Uint16(sourceParam string, dest *uint16) *ValueBinder

+ func (b *ValueBinder) Uint16s(sourceParam string, dest *[]uint16) *ValueBinder

+ func (b *ValueBinder) Uint32(sourceParam string, dest *uint32) *ValueBinder

+ func (b *ValueBinder) Uint32s(sourceParam string, dest *[]uint32) *ValueBinder

+ func (b *ValueBinder) Uint64(sourceParam string, dest *uint64) *ValueBinder

+ func (b *ValueBinder) Uint64s(sourceParam string, dest *[]uint64) *ValueBinder

+ func (b *ValueBinder) Uint8(sourceParam string, dest *uint8) *ValueBinder

+ func (b *ValueBinder) Uint8s(sourceParam string, dest *[]uint8) *ValueBinder

+ func (b *ValueBinder) Uints(sourceParam string, dest *[]uint) *ValueBinder

+ func (b *ValueBinder) UnixTime(sourceParam string, dest *time.Time) *ValueBinder

+ func (b *ValueBinder) UnixTimeNano(sourceParam string, dest *time.Time) *ValueBinder

Aug 28, 2020 GO-2021-0051 +15 more

  GO-2021-0051: Directory traversal on Windows in github.com/labstack/echo/v4

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

+ func GetPath(r *http.Request) string

type HTTPError

+ func (he *HTTPError) Unwrap() error

Mar 30, 2020 GO-2021-0051 +15 more

  GO-2021-0051: Directory traversal on Windows in github.com/labstack/echo/v4

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Feb 29, 2020 GO-2021-0051 +15 more

  GO-2021-0051: Directory traversal on Windows in github.com/labstack/echo/v4

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

type Echo

+ IPExtractor IPExtractor

+ func (e *Echo) StartH2CServer(address string, h2s *http2.Server) (err error)

+ type IPExtractor func(*http.Request) string

+ func ExtractIPDirect() IPExtractor

+ func ExtractIPFromRealIPHeader(options ...TrustOption) IPExtractor

+ func ExtractIPFromXFFHeader(options ...TrustOption) IPExtractor

+ type TrustOption func(*ipChecker)

+ func TrustIPRange(ipRange *net.IPNet) TrustOption

+ func TrustLinkLocal(v bool) TrustOption

+ func TrustLoopback(v bool) TrustOption

+ func TrustPrivateNet(v bool) TrustOption

Jan 24, 2020 GO-2021-0051 +15 more

  GO-2021-0051: Directory traversal on Windows in github.com/labstack/echo/v4

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Jan 1, 2020 GO-2021-0051 +15 more

  GO-2021-0051: Directory traversal on Windows in github.com/labstack/echo/v4

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Dec 30, 2019 GO-2021-0051 +15 more

  GO-2021-0051: Directory traversal on Windows in github.com/labstack/echo/v4

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

type Context

+ SetLogger func(l Logger)

Oct 7, 2019 GO-2021-0051 +15 more

  GO-2021-0051: Directory traversal on Windows in github.com/labstack/echo/v4

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Aug 17, 2019 GO-2021-0051 +15 more

  GO-2021-0051: Directory traversal on Windows in github.com/labstack/echo/v4

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Aug 11, 2019 GO-2021-0051 +15 more

  GO-2021-0051: Directory traversal on Windows in github.com/labstack/echo/v4

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

type Context

+ SetResponse func(r *Response)

Aug 5, 2019 GO-2021-0051 +15 more

  GO-2021-0051: Directory traversal on Windows in github.com/labstack/echo/v4

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Aug 2, 2019 GO-2021-0051 +15 more

  GO-2021-0051: Directory traversal on Windows in github.com/labstack/echo/v4

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

+ const HeaderReferrerPolicy

Jun 9, 2019 GO-2021-0051 +15 more

  GO-2021-0051: Directory traversal on Windows in github.com/labstack/echo/v4

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

+ const REPORT

Apr 30, 2019 GO-2021-0051 +15 more

  GO-2021-0051: Directory traversal on Windows in github.com/labstack/echo/v4

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Apr 29, 2019 GO-2021-0051 +15 more

  GO-2021-0051: Directory traversal on Windows in github.com/labstack/echo/v4

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Apr 29, 2019 GO-2021-0051 +15 more

  GO-2021-0051: Directory traversal on Windows in github.com/labstack/echo/v4

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Apr 29, 2019 GO-2021-0051 +15 more

  GO-2021-0051: Directory traversal on Windows in github.com/labstack/echo/v4

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Apr 29, 2019 GO-2021-0051 +15 more

  GO-2021-0051: Directory traversal on Windows in github.com/labstack/echo/v4

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

type Echo

+ func (e *Echo) Routers() map[string]*Router

Apr 29, 2019 GO-2021-0051 +15 more

  GO-2021-0051: Directory traversal on Windows in github.com/labstack/echo/v4

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

+ const HeaderContentSecurityPolicyReportOnly

+ var ErrInvalidCertOrKeyType = errors.New("invalid cert or key type, must be string or []byte")

type Echo

+ func (e *Echo) Host(name string, m ...MiddlewareFunc) (g *Group)

Jan 30, 2019 GO-2021-0051 +15 more

  GO-2021-0051: Directory traversal on Windows in github.com/labstack/echo/v4

  GO-2022-1031: Open redirect in github.com/labstack/echo/v4

  GO-2026-6293: Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

  GO-2026-6842: Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

  GO-2026-6872: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6878: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo

  GO-2026-6885: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo

Changes in this version

+ const CONNECT

+ const DELETE

+ const GET

+ const HEAD

+ const HeaderAccept

+ const HeaderAcceptEncoding

+ const HeaderAccessControlAllowCredentials

+ const HeaderAccessControlAllowHeaders

+ const HeaderAccessControlAllowMethods

+ const HeaderAccessControlAllowOrigin

+ const HeaderAccessControlExposeHeaders

+ const HeaderAccessControlMaxAge

+ const HeaderAccessControlRequestHeaders

+ const HeaderAccessControlRequestMethod

+ const HeaderAllow

+ const HeaderAuthorization

+ const HeaderContentDisposition

+ const HeaderContentEncoding

+ const HeaderContentLength

+ const HeaderContentSecurityPolicy

+ const HeaderContentType

+ const HeaderCookie

+ const HeaderIfModifiedSince

+ const HeaderLastModified

+ const HeaderLocation

+ const HeaderOrigin

+ const HeaderServer

+ const HeaderSetCookie

+ const HeaderStrictTransportSecurity

+ const HeaderUpgrade

+ const HeaderVary

+ const HeaderWWWAuthenticate

+ const HeaderXCSRFToken

+ const HeaderXContentTypeOptions

+ const HeaderXForwardedFor

+ const HeaderXForwardedProto

+ const HeaderXForwardedProtocol

+ const HeaderXForwardedSsl

+ const HeaderXFrameOptions

+ const HeaderXHTTPMethodOverride

+ const HeaderXRealIP

+ const HeaderXRequestID

+ const HeaderXRequestedWith

+ const HeaderXUrlScheme

+ const HeaderXXSSProtection

+ const MIMEApplicationForm

+ const MIMEApplicationJSON

+ const MIMEApplicationJSONCharsetUTF8

+ const MIMEApplicationJavaScript

+ const MIMEApplicationJavaScriptCharsetUTF8

+ const MIMEApplicationMsgpack

+ const MIMEApplicationProtobuf

+ const MIMEApplicationXML

+ const MIMEApplicationXMLCharsetUTF8

+ const MIMEMultipartForm

+ const MIMEOctetStream

+ const MIMETextHTML

+ const MIMETextHTMLCharsetUTF8

+ const MIMETextPlain

+ const MIMETextPlainCharsetUTF8

+ const MIMETextXML

+ const MIMETextXMLCharsetUTF8

+ const OPTIONS

+ const PATCH

+ const POST

+ const PROPFIND

+ const PUT

+ const TRACE

+ const Version

+ var ErrBadGateway = NewHTTPError(http.StatusBadGateway)

+ var ErrBadRequest = NewHTTPError(http.StatusBadRequest)

+ var ErrCookieNotFound = errors.New("cookie not found")

+ var ErrForbidden = NewHTTPError(http.StatusForbidden)

+ var ErrInternalServerError = NewHTTPError(http.StatusInternalServerError)

+ var ErrInvalidRedirectCode = errors.New("invalid redirect status code")

+ var ErrMethodNotAllowed = NewHTTPError(http.StatusMethodNotAllowed)

+ var ErrNotFound = NewHTTPError(http.StatusNotFound)

+ var ErrRendererNotRegistered = errors.New("renderer not registered")

+ var ErrRequestTimeout = NewHTTPError(http.StatusRequestTimeout)

+ var ErrServiceUnavailable = NewHTTPError(http.StatusServiceUnavailable)

+ var ErrStatusRequestEntityTooLarge = NewHTTPError(http.StatusRequestEntityTooLarge)

+ var ErrTooManyRequests = NewHTTPError(http.StatusTooManyRequests)

+ var ErrUnauthorized = NewHTTPError(http.StatusUnauthorized)

+ var ErrUnsupportedMediaType = NewHTTPError(http.StatusUnsupportedMediaType)

+ var ErrValidatorNotRegistered = errors.New("validator not registered")

+ var MethodNotAllowedHandler = func(c Context) error

+ var NotFoundHandler = func(c Context) error

+ type BindUnmarshaler interface

+ UnmarshalParam func(param string) error

+ type Binder interface

+ Bind func(i interface{}, c Context) error

+ type Context interface

+ Attachment func(file string, name string) error

+ Bind func(i interface{}) error

+ Blob func(code int, contentType string, b []byte) error

+ Cookie func(name string) (*http.Cookie, error)

+ Cookies func() []*http.Cookie

+ Echo func() *Echo

+ Error func(err error)

+ File func(file string) error

+ FormFile func(name string) (*multipart.FileHeader, error)

+ FormParams func() (url.Values, error)

+ FormValue func(name string) string

+ Get func(key string) interface{}

+ HTML func(code int, html string) error

+ HTMLBlob func(code int, b []byte) error

+ Handler func() HandlerFunc

+ Inline func(file string, name string) error

+ IsTLS func() bool

+ IsWebSocket func() bool

+ JSON func(code int, i interface{}) error

+ JSONBlob func(code int, b []byte) error

+ JSONP func(code int, callback string, i interface{}) error

+ JSONPBlob func(code int, callback string, b []byte) error

+ JSONPretty func(code int, i interface{}, indent string) error

+ Logger func() Logger

+ MultipartForm func() (*multipart.Form, error)

+ NoContent func(code int) error

+ Param func(name string) string

+ ParamNames func() []string

+ ParamValues func() []string

+ Path func() string

+ QueryParam func(name string) string

+ QueryParams func() url.Values

+ QueryString func() string

+ RealIP func() string

+ Redirect func(code int, url string) error

+ Render func(code int, name string, data interface{}) error

+ Request func() *http.Request

+ Reset func(r *http.Request, w http.ResponseWriter)

+ Response func() *Response

+ Scheme func() string

+ Set func(key string, val interface{})

+ SetCookie func(cookie *http.Cookie)

+ SetHandler func(h HandlerFunc)

+ SetParamNames func(names ...string)

+ SetParamValues func(values ...string)

+ SetPath func(p string)

+ SetRequest func(r *http.Request)

+ Stream func(code int, contentType string, r io.Reader) error

+ String func(code int, s string) error

+ Validate func(i interface{}) error

+ XML func(code int, i interface{}) error

+ XMLBlob func(code int, b []byte) error

+ XMLPretty func(code int, i interface{}, indent string) error

+ type DefaultBinder struct

+ func (b *DefaultBinder) Bind(i interface{}, c Context) (err error)

+ type Echo struct

+ AutoTLSManager autocert.Manager

+ Binder Binder

+ Debug bool

+ DisableHTTP2 bool

+ HTTPErrorHandler HTTPErrorHandler

+ HideBanner bool

+ HidePort bool

+ Listener net.Listener

+ Logger Logger

+ Renderer Renderer

+ Server *http.Server

+ StdLogger *stdLog.Logger

+ TLSListener net.Listener

+ TLSServer *http.Server

+ Validator Validator

+ func New() (e *Echo)

+ func (e *Echo) AcquireContext() Context

+ func (e *Echo) Add(method, path string, handler HandlerFunc, middleware ...MiddlewareFunc) *Route

+ func (e *Echo) Any(path string, handler HandlerFunc, middleware ...MiddlewareFunc) []*Route

+ func (e *Echo) CONNECT(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

+ func (e *Echo) Close() error

+ func (e *Echo) DELETE(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

+ func (e *Echo) DefaultHTTPErrorHandler(err error, c Context)

+ func (e *Echo) File(path, file string, m ...MiddlewareFunc) *Route

+ func (e *Echo) GET(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

+ func (e *Echo) Group(prefix string, m ...MiddlewareFunc) (g *Group)

+ func (e *Echo) HEAD(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

+ func (e *Echo) Match(methods []string, path string, handler HandlerFunc, ...) []*Route

+ func (e *Echo) NewContext(r *http.Request, w http.ResponseWriter) Context

+ func (e *Echo) OPTIONS(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

+ func (e *Echo) PATCH(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

+ func (e *Echo) POST(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

+ func (e *Echo) PUT(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

+ func (e *Echo) Pre(middleware ...MiddlewareFunc)

+ func (e *Echo) ReleaseContext(c Context)

+ func (e *Echo) Reverse(name string, params ...interface{}) string

+ func (e *Echo) Router() *Router

+ func (e *Echo) Routes() []*Route

+ func (e *Echo) ServeHTTP(w http.ResponseWriter, r *http.Request)

+ func (e *Echo) Shutdown(ctx stdContext.Context) error

+ func (e *Echo) Start(address string) error

+ func (e *Echo) StartAutoTLS(address string) error

+ func (e *Echo) StartServer(s *http.Server) (err error)

+ func (e *Echo) StartTLS(address string, certFile, keyFile string) (err error)

+ func (e *Echo) Static(prefix, root string) *Route

+ func (e *Echo) TRACE(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

+ func (e *Echo) URI(handler HandlerFunc, params ...interface{}) string

+ func (e *Echo) URL(h HandlerFunc, params ...interface{}) string

+ func (e *Echo) Use(middleware ...MiddlewareFunc)

+ type Group struct

+ func (g *Group) Add(method, path string, handler HandlerFunc, middleware ...MiddlewareFunc) *Route

+ func (g *Group) Any(path string, handler HandlerFunc, middleware ...MiddlewareFunc) []*Route

+ func (g *Group) CONNECT(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

+ func (g *Group) DELETE(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

+ func (g *Group) File(path, file string)

+ func (g *Group) GET(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

+ func (g *Group) Group(prefix string, middleware ...MiddlewareFunc) *Group

+ func (g *Group) HEAD(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

+ func (g *Group) Match(methods []string, path string, handler HandlerFunc, ...) []*Route

+ func (g *Group) OPTIONS(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

+ func (g *Group) PATCH(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

+ func (g *Group) POST(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

+ func (g *Group) PUT(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

+ func (g *Group) Static(prefix, root string)

+ func (g *Group) TRACE(path string, h HandlerFunc, m ...MiddlewareFunc) *Route

+ func (g *Group) Use(middleware ...MiddlewareFunc)

+ type HTTPError struct

+ Code int

+ Internal error

+ Message interface{}

+ func NewHTTPError(code int, message ...interface{}) *HTTPError

+ func (he *HTTPError) Error() string

+ func (he *HTTPError) SetInternal(err error) *HTTPError

+ type HTTPErrorHandler func(error, Context)

+ type HandlerFunc func(Context) error

+ func WrapHandler(h http.Handler) HandlerFunc

+ type Logger interface

+ Debug func(i ...interface{})

+ Debugf func(format string, args ...interface{})

+ Debugj func(j log.JSON)

+ Error func(i ...interface{})

+ Errorf func(format string, args ...interface{})

+ Errorj func(j log.JSON)

+ Fatal func(i ...interface{})

+ Fatalf func(format string, args ...interface{})

+ Fatalj func(j log.JSON)

+ Info func(i ...interface{})

+ Infof func(format string, args ...interface{})

+ Infoj func(j log.JSON)

+ Level func() log.Lvl

+ Output func() io.Writer

+ Panic func(i ...interface{})

+ Panicf func(format string, args ...interface{})

+ Panicj func(j log.JSON)

+ Prefix func() string

+ Print func(i ...interface{})

+ Printf func(format string, args ...interface{})

+ Printj func(j log.JSON)

+ SetHeader func(h string)

+ SetLevel func(v log.Lvl)

+ SetOutput func(w io.Writer)

+ SetPrefix func(p string)

+ Warn func(i ...interface{})

+ Warnf func(format string, args ...interface{})

+ Warnj func(j log.JSON)

+ type Map map[string]interface

+ type MiddlewareFunc func(HandlerFunc) HandlerFunc

+ func WrapMiddleware(m func(http.Handler) http.Handler) MiddlewareFunc

+ type Renderer interface

+ Render func(io.Writer, string, interface{}, Context) error

+ type Response struct

+ Committed bool

+ Size int64

+ Status int

+ Writer http.ResponseWriter

+ func NewResponse(w http.ResponseWriter, e *Echo) (r *Response)

+ func (r *Response) After(fn func())

+ func (r *Response) Before(fn func())

+ func (r *Response) Flush()

+ func (r *Response) Header() http.Header

+ func (r *Response) Hijack() (net.Conn, *bufio.ReadWriter, error)

+ func (r *Response) Write(b []byte) (n int, err error)

+ func (r *Response) WriteHeader(code int)

+ type Route struct

+ Method string

+ Name string

+ Path string

+ type Router struct

+ func NewRouter(e *Echo) *Router

+ func (r *Router) Add(method, path string, h HandlerFunc)

+ func (r *Router) Find(method, path string, c Context)

+ type Validator interface

+ Validate func(i interface{}) error