introduce MergePathStrategy for #521 #519 #523
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
I need this as soon as possible :) Please merge and release new version |
SVilgelm
reviewed
Mar 2, 2023
route_builder.go
Outdated
| // MergePathStrategy is the active strategy for merging a Route path when building the routing of all WebServices. | ||
| // The value is set to TrimSlashStrategy | ||
| // PathJoinStrategy is an alternative strategy that is more strict [Security - PRISMA-2022-0227] | ||
| MergePathStrategy = TrimSlashStrategy |
There was a problem hiding this comment.
I think you need to set it to PathJoinStrategy as default
There was a problem hiding this comment.
yes, agree. Reason for it is because that will fix the security issue that motivated the change (which turned out to be a breaking one).
SVilgelm
reviewed
Mar 5, 2023
README.md
Outdated
| @@ -96,6 +96,10 @@ There are several hooks to customize the behavior of the go-restful package. | |||
| - Compression | |||
| - Encoders for other serializers | |||
| - Use [jsoniter](https://github.com/json-iterator/go) by building this package using a build tag, e.g. `go build -tags=jsoniter .` | |||
| - Use the variable `MergePathStrategy` to change the behaviour of composing the Route path given a root path and a local route path | |||
| - versions >= 3.10.1 has set the value to `PathJoinStrategy` that fixes a reported security issue but may cause your services not to work correctly anymore. | |||
There was a problem hiding this comment.
could you please add a link to the issue that was fixed?
brandond
added a commit
to brandond/k3s
that referenced
this pull request
May 24, 2023
Fix regression in legacy API prefix, until upstream pulls in support for MergePathStrategy from emicklei/go-restful#523 Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
brandond
added a commit
to brandond/k3s
that referenced
this pull request
May 24, 2023
Fix regression in legacy API prefix, until upstream pulls in support for MergePathStrategy from emicklei/go-restful#523 Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
brandond
added a commit
to k3s-io/k3s
that referenced
this pull request
May 24, 2023
Fix regression in legacy API prefix, until upstream pulls in support for MergePathStrategy from emicklei/go-restful#523 Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
brandond
added a commit
to k3s-io/k3s
that referenced
this pull request
May 24, 2023
Fix regression in legacy API prefix, until upstream pulls in support for MergePathStrategy from emicklei/go-restful#523 Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
emicklei
added a commit
that referenced
this pull request
Aug 5, 2023
* allow multiple samples for Write, issue #514 * update changelog * chore: example handling request parameters with httpin (#518) * use path package to join slash fragments #519 (#520) * update hist * update example openapi to use 3.10.1 * Add test for client request with and without trailing slash. (#522) * Add test for client request with and without trailing slash. * Correction. * introduce MergePathStrategy * Revert "introduce MergePathStrategy" This reverts commit 709cf80. * introduce MergePathStrategy for #521 #519 (#523) * introduce MergePathStrategy for #521 #519 * update readme, set default to new strategy, add extra test * link to security issue * update change hist * add hello world with TrimSlashStrategy * two route example * examples to show differences #519 * more route examples #519 * add examples for issue519 with path in root * remove obsolete swagger example * Update README.md remover swagger12 mention * allow multiple samples for Write, issue #514 --------- Co-authored-by: Ggicci <ggicci.t@gmail.com> Co-authored-by: Gerrit <Gerrit91@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.