fix(deps): update module github.com/go-chi/chi/v5 to v5.2.2 [security] #2124
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Member
|
This is a test-only dependency, so not bumping the version to fix a CVE that won't affect us 👍 https://github.com/oapi-codegen/.github/blob/main/SECURITY.md#cves-in-dependencies |
Contributor
Author
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update ( If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v5.0.10->v5.2.2GitHub Vulnerability Alerts
GHSA-vrw8-fxc6-2r93
Summary
The RedirectSlashes function in middleware/strip.go is vulnerable to host header injection which leads to open redirect.
We consider this a lower-severity open redirect, as it can't be exploited from browsers or email clients (requires manipulation of a Host header).
Details
The RedirectSlashes method uses the Host header to construct the redirectURL at this line https://github.com/go-chi/chi/blob/master/middleware/strip.go#L55
The Host header can be manipulated by a user to be any arbitrary host. This leads to open redirect when using the RedirectSlashes middleware
PoC
Create a simple server which uses the RedirectSlashes middleware
Run the server
go run main.goOnce the server is running, send a request that will trigger the RedirectSlashes function with an arbitrary Host header
curl -iL -H "Host: example.com" http://localhost:8080/test/Observe that the request will be redirected to example.com
Without the host header, the response is returned from the test server
Impact
An open redirect vulnerability allows attackers to trick users into visiting malicious sites. This can lead to phishing attacks, credential theft, and malware distribution, as users trust the application’s domain while being redirected to harmful sites.
Potential mitigation
It seems that the purpose of the RedirectSlashes function is to redirect within the same application. In that case r.RequestURI can be used instead of r.Host by default. If there is a use case to redirect to a different host, a flag can be added to use the Host header instead. As this flag will be controlled by the developer they will make the decision of allowing redirects to arbitrary hosts based on their judgement.
Release Notes
go-chi/chi (github.com/go-chi/chi/v5)
v5.2.2Compare Source
What's Changed
Security fix
New Contributors
Full Changelog: go-chi/chi@v5.2.1...v5.2.2
v5.2.1Compare Source
Starting this release, we will now support the four most recent major versions of Go. See #963 for related discussion.
What's Changed
Full Changelog: go-chi/chi@v5.2.0...v5.2.1
v5.2.0Compare Source
What's Changed
FindtoRoutesinterface by @joeriddles in #872feat(): add CF-Connecting-IP by @n33pm in #908Revert "feat(): add CF-Connecting-IP" by @VojtechVitek in #966_examples/versionsby @hongkuancn in #948Mux.Findnot correctly handling nested routes by @joeriddles in #954New Contributors
Full Changelog: go-chi/chi@v5.1.0...v5.2.0
v5.1.0Compare Source
What's Changed
Discard()method to themiddleware.WrapResponseWriterinterface. This is technically an API breaking change. However after some discussion at #926 (comment), we decided to move forward, and release as minor version, as we don't expect anyone to rely on this interface / implement it externally.New Contributors
Full Changelog: go-chi/chi@v5.0.14...v5.1.0
v5.0.14Compare Source
What's Changed
New Contributors
Full Changelog: go-chi/chi@v5.0.12...v5.0.14
v5.0.13Compare Source
What's Changed
New Contributors
Full Changelog: go-chi/chi@v5.0.12...v5.0.13
v5.0.12Compare Source
v5.0.11Compare Source
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.