use exact matching of allowed domain entries, issue #489 (#493) #503
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…cklei#493) * use exact matching of allowed domain entries, issue emicklei#489 * update doc, add testcases from PR conversation * introduce AllowedDomainFunc emicklei#489 * more tests, fix doc * lowercase origin before checking cors
|
Codecov ReportAll modified and coverable lines are covered by tests ✅
❗ Your organization needs to install the Codecov GitHub app to enable full functionality. Additional details and impacted files@@ Coverage Diff @@
## master #503 +/- ##
==========================================
+ Coverage 70.35% 70.47% +0.12%
==========================================
Files 26 26
Lines 1545 1531 -14
==========================================
- Hits 1087 1079 -8
+ Misses 386 383 -3
+ Partials 72 69 -3 ☔ View full report in Codecov by Sentry. |
emicklei
approved these changes
Jul 11, 2022
|
@L3n41c thank you for contributing |
9 tasks
|
This is still showing up in trivy (2.16.0 as vulnerable) |
Barakmor1
pushed a commit
to Barakmor1/kubevirt
that referenced
this pull request
Jul 14, 2022
Because of a security issue in go-restful v2.15.0 emicklei/go-restful#503 Signed-off-by: bmordeha <bmodeha@redhat.com>
kubevirt-bot
pushed a commit
to kubevirt-bot/kubevirt
that referenced
this pull request
Jul 17, 2022
…in go-restful v2.15.0 emicklei/go-restful#503 Signed-off-by: bmordeha <bmodeha@redhat.com>
|
maybe trivy cannot handle the fact that we have 2 active branches (with and without Go modules). |
vasiliy-ul
added a commit
to vasiliy-ul/containerized-data-importer
that referenced
this pull request
Jul 26, 2022
The updated version fixes 'Authorization Bypass Through User-Controlled Key' vulnerability (CVE-2022-1996). References: emicklei/go-restful#489 emicklei/go-restful#503 Signed-off-by: Vasiliy Ulyanov <vulyanov@suse.de>
kubevirt-bot
pushed a commit
to kubevirt/containerized-data-importer
that referenced
this pull request
Jul 27, 2022
The updated version fixes 'Authorization Bypass Through User-Controlled Key' vulnerability (CVE-2022-1996). References: emicklei/go-restful#489 emicklei/go-restful#503 Signed-off-by: Vasiliy Ulyanov <vulyanov@suse.de>
This was referenced Sep 2, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport #493 to fix #489 on the
v2stream ofgo-restful.Some GO projects might have indirect dependencies to the
v2version ofemicklei/go-restfulso that upgrading tov3.8.0isn’t trivial.See #489 (comment).