Unauthenticated clients could exhaust process memory (and, for /store,
disk) by posting arbitrarily large bodies, and could OOM or pin
goroutines via the /ws/echo websocket.
- Wrap request bodies in http.MaxBytesReader (10 MiB) on the echo,
store, cache and token handlers via a shared readLimitedBody helper
- Bound /ws/echo: per-message read limit, idle read deadline with
ping/pong keepalive, and write deadlines
- Add regression tests for both limits
HttpServerTimeout is a time.Duration (nanoseconds); the default-delay
branch scaled it by time.Second again, overflowing int64 to a negative
value and passing it to rand.Intn, which panics. The bare /chunked route
(no wait param) hit this on every request.
Convert the timeout to whole seconds in a guarded helper that keeps
rand.Intn's argument positive, and add a regression test.
Adds a process-wide toggle that makes podinfo respond with HTTP 500 to all application endpoints while keeping Kubernetes probes, metrics, pprof and the control endpoints functional. This allows a single replica to be made selectively 'sick' to test client-side circuit breakers / outlier detection (Envoy, Istio DestinationRule.outlierDetection, etc.) without Kubernetes evicting the pod.
New endpoints:
POST /fault_injection/enable
POST /fault_injection/disable
GET /fault_injection/status
Includes unit tests for the handlers, the middleware behavior, and the path exclusion list.
Regression test for CVE-2026-43644, mirroring the TestStoreReadHandler_ContentType
test added in #463. Verifies the echoHandler direct-response branch returns
application/octet-stream, X-Content-Type-Options: nosniff, and a restrictive CSP
so an HTML payload cannot be MIME-sniffed and executed.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Validate that the hash URL parameter matches the expected SHA1 hex
format (40 lowercase hex characters) before using it in file path
operations.
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
Set Content-Type to application/octet-stream in storeReadHandler
to prevent Go's content sniffing from serving HTML payloads as
text/html. Add X-Content-Type-Options: nosniff to prevent browsers
from overriding Content-Type via MIME sniffing, and
Content-Security-Policy: default-src 'none' to block script
execution as defense-in-depth.
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
Now it is possible to use the swagger webinterface
running on a host other than localhost e.g. in docker
or kubernetes.
Removed the @host line from pkg/api/server.go and
ran make swagger.
Fixes probably #179
Fix GET /panic
The GET /panic api call is not working due the the logger.Panic method
failing to call panic. This change replaces the logger.Panic method
call with logger.Info and adds a call to os.Exit(255).
Stefan Prodan
Danny Kulchinsky
Piotr Roszatycki
Niccolò ParlantiandClaude Opus 4.7
Niccolò Parlanti
Hans van den Bogert
Prashant Dwivedi
Rodrigo Fior Kuntzer
needsure
Michael KebeandMichael Kebe
JayKaku
Jacob Chambliss
Kajetan
FlomoN
FlomoN
Paul CarltonandGitHub
Martín Montes
Rajat Vig
Ilya DmitrichenkoandRajat Vig