mirrors/pkg-proxy
Watch
1
0
Fork
You've already forked pkg-proxy
 1
mirror of https://github.com/git-pkgs/proxy.git synced 2026-08-01 10:08:08 -04:00
Code Issues Releases Packages Wiki Activity
pkg-proxy/internal/server
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Andrew Nesbitt 37cc7abfc7
 Validate package paths before database lookups 
The wildcard package routes (/packages/{ecosystem}/*, /api/package/*,
/api/vulns/*, /api/browse/*, /api/compare/*) only checked for an empty
path before passing user input to GetPackageByEcosystemName and the
enrichment service.

Add validatePackagePath as a coarse first-line filter: reject null
bytes, other control characters, and paths over 512 bytes. Wired into
all five entry handlers immediately after the chi wildcard is read.

This is the generic layer; ecosystem-specific name format rules (npm
scoped name shape, Maven coordinate structure, etc.) can be added on
top per #75.

Fixes #75
2026-05-03 09:02:14 +01:00
..
static Add Container, Debian, RPM handlers and enrichment API 2026-01-29 19:35:15 +00:00
templates Escape user-controlled strings in browse source JavaScript 2026-03-12 11:59:14 +00:00
api.go Validate package paths before database lookups 2026-05-03 09:02:14 +01:00
api_test.go Validate package paths before database lookups 2026-05-03 09:02:14 +01:00
browse.go Validate package paths before database lookups 2026-05-03 09:02:14 +01:00
browse_test.go Limit io.ReadAll in openArchive to 512 MB (#104) 2026-05-02 18:00:22 +01:00
dashboard.go Sort the ecosystems list for presentation in the UI 2026-04-06 18:06:16 -04:00
eviction.go Enforce max_size config with LRU cache eviction 2026-04-30 18:09:01 +01:00
eviction_test.go Enforce max_size config with LRU cache eviction 2026-04-30 18:09:01 +01:00
middleware.go Refactoring and features 2026-02-03 22:40:40 +00:00
middleware_test.go Add handler download flow and server utility tests 2026-03-17 20:31:54 +00:00
mirror_api.go Add MaxBytesReader to mirror API HandleCreate (#105) 2026-05-02 18:00:25 +01:00
mirror_api_test.go Add MaxBytesReader to mirror API HandleCreate (#105) 2026-05-02 18:00:25 +01:00
packages_list_test.go Fix all golangci-lint issues across the codebase (#32) 2026-03-18 10:59:29 +00:00
resolve.go Validate package paths before database lookups 2026-05-03 09:02:14 +01:00
resolve_test.go Validate package paths before database lookups 2026-05-03 09:02:14 +01:00
server.go Validate package paths before database lookups 2026-05-03 09:02:14 +01:00
server_test.go Add mirror command and API for selective package mirroring 2026-04-13 09:01:04 +01:00
static.go Add Container, Debian, RPM handlers and enrichment API 2026-01-29 19:35:15 +00:00
swagger_gen.go Add generated OpenAPI docs support 2026-03-12 11:49:31 +00:00
templates.go Lazy-load HTML templates behind sync.Once (#59) 2026-04-06 13:06:25 +01:00
templates_test.go Apply 'go fmt' as suggested in CONTRIBUTING.md. 2026-04-18 07:43:22 -04:00