From 0d6d4a0dffcc4565e55d2eacf92ffab9cdab0a40 Mon Sep 17 00:00:00 2001 From: Trong Huu Nguyen Date: Tue, 28 Jul 2026 11:10:18 +0200 Subject: [PATCH] fix(http): encode the unauthenticated response as JSON The response was built by concatenating the request path into a JSON string. The path is percent-decoded, so it can contain quotes and backslashes, which produced malformed JSON and let a caller inject arbitrary keys into the object. --- internal/http/middleware.go | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/internal/http/middleware.go b/internal/http/middleware.go index 54b2cb4..5a588a6 100644 --- a/internal/http/middleware.go +++ b/internal/http/middleware.go @@ -1,6 +1,7 @@ package http import ( + "encoding/json" "net/http" "go.opentelemetry.io/otel/attribute" @@ -24,7 +25,15 @@ func DisallowNonNavigationalRequests(next http.Handler) http.Handler { w.Header().Set("Content-Type", "application/json") w.WriteHeader(http.StatusUnauthorized) - _, _ = w.Write([]byte(`{"error": "unauthenticated", "error_description": "this is an interactive endpoint; user-agents must be navigated to this endpoint", "error_path": "` + r.URL.Path + `"}`)) + _ = json.NewEncoder(w).Encode(struct { + Error string `json:"error"` + ErrorDescription string `json:"error_description"` + ErrorPath string `json:"error_path"` + }{ + Error: "unauthenticated", + ErrorDescription: "this is an interactive endpoint; user-agents must be navigated to this endpoint", + ErrorPath: r.URL.Path, + }) return }