Unauthenticated clients could exhaust process memory (and, for /store,
disk) by posting arbitrarily large bodies, and could OOM or pin
goroutines via the /ws/echo websocket.
- Wrap request bodies in http.MaxBytesReader (10 MiB) on the echo,
store, cache and token handlers via a shared readLimitedBody helper
- Bound /ws/echo: per-message read limit, idle read deadline with
ping/pong keepalive, and write deadlines
- Add regression tests for both limits
HttpServerTimeout is a time.Duration (nanoseconds); the default-delay
branch scaled it by time.Second again, overflowing int64 to a negative
value and passing it to rand.Intn, which panics. The bare /chunked route
(no wait param) hit this on every request.
Convert the timeout to whole seconds in a guarded helper that keeps
rand.Intn's argument positive, and add a regression test.
Adds a process-wide toggle that makes podinfo respond with HTTP 500 to all application endpoints while keeping Kubernetes probes, metrics, pprof and the control endpoints functional. This allows a single replica to be made selectively 'sick' to test client-side circuit breakers / outlier detection (Envoy, Istio DestinationRule.outlierDetection, etc.) without Kubernetes evicting the pod.
New endpoints:
POST /fault_injection/enable
POST /fault_injection/disable
GET /fault_injection/status
Includes unit tests for the handlers, the middleware behavior, and the path exclusion list.
Regression test for CVE-2026-43644, mirroring the TestStoreReadHandler_ContentType
test added in #463. Verifies the echoHandler direct-response branch returns
application/octet-stream, X-Content-Type-Options: nosniff, and a restrictive CSP
so an HTML payload cannot be MIME-sniffed and executed.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Adds a loggerprovider based on otlp logger
- In demo directory of oltp:
- Added grafana for unified view of both traces and logs
- tracing now uses oltp from the collector to the jaeger instance
Signed-off-by: Hans van den Bogert <hansbogert@gmail.com>
Validate that the hash URL parameter matches the expected SHA1 hex
format (40 lowercase hex characters) before using it in file path
operations.
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
Set Content-Type to application/octet-stream in storeReadHandler
to prevent Go's content sniffing from serving HTML payloads as
text/html. Add X-Content-Type-Options: nosniff to prevent browsers
from overriding Content-Type via MIME sniffing, and
Content-Security-Policy: default-src 'none' to block script
execution as defense-in-depth.
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
Now it is possible to use the swagger webinterface
running on a host other than localhost e.g. in docker
or kubernetes.
Removed the @host line from pkg/api/server.go and
ran make swagger.
Fixes probably #179
Stefan Prodan
Danny Kulchinsky
Piotr Roszatycki
Niccolò ParlantiandClaude Opus 4.7
Niccolò Parlanti
Hans van den Bogert
Prashant Dwivedi
Rodrigo Fior Kuntzer
needsure
Michael KebeandMichael Kebe
JayKaku