mirror of
https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin.git
synced 2026-07-19 18:52:20 +02:00
d32f271195
* 🐛 fix appsec silently 403-ing gRPC streams with unreadable body A bidirectional gRPC stream is an HTTP/2 request with no Content-Length whose body never reaches EOF. Since #321 removed the ContentLength guard, appsecQuery buffered it with io.ReadAll, which blocked until the request timed out and was turned into a 403 (issue #323). The backend was never reached (OriginStatus:0). Mirror the reference lua-cs-bouncer behaviour: detect an unreadable body (ProtoMajor >= 2 && ContentLength < 0) and, instead of buffering it, forward the request to Appsec with headers only. Add a new CrowdsecAppsecDropUnreadableBody option (default false) that mirrors the reference APPSEC_DROP_UNREADABLE_BODY: when true, such requests are blocked outright instead of forwarded without their body. Readable HTTP/1.1 bodies are still buffered and inspected, so the bypass closed by #321 stays closed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * 🚨 appsec: satisfy linters (gocritic ifElseChain, misspell) Rewrite the body-handling if/else chain in appsecQuery as a switch (gocritic) and use US spelling "behavior" (misspell). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * 🔇 appsec: drop redundant unreadable-body debug log Address review on #332: the caller (handleNextServeHTTP) already logs the returned error with the request IP, so the inner Debug line duplicated it. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * 🍱 increase gocyclo * 🍱 fix lint --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: maxlerebourg <maxlerebourg@gmail.com>
88 lines
2.2 KiB
YAML
88 lines
2.2 KiB
YAML
run:
|
|
timeout: 3m
|
|
|
|
linters-settings:
|
|
govet:
|
|
enable-all: true
|
|
disable:
|
|
- fieldalignment
|
|
gocyclo:
|
|
min-complexity: 20
|
|
goconst:
|
|
min-len: 5
|
|
min-occurrences: 4
|
|
misspell:
|
|
locale: US
|
|
funlen:
|
|
lines: -1
|
|
statements: 60
|
|
godox:
|
|
keywords:
|
|
- FIXME
|
|
gofumpt:
|
|
extra-rules: true
|
|
depguard:
|
|
rules:
|
|
Main:
|
|
files:
|
|
- $all
|
|
- "!$test"
|
|
allow:
|
|
- $gostd
|
|
- github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/logger
|
|
- github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/ip
|
|
- github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/configuration
|
|
- github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/cache
|
|
- github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/captcha
|
|
- github.com/leprosus/golang-ttl-map
|
|
- github.com/maxlerebourg/simpleredis
|
|
Test:
|
|
files:
|
|
- $test
|
|
allow:
|
|
- $gostd
|
|
- github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/logger
|
|
- github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/ip
|
|
- github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/configuration
|
|
- github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/cache
|
|
- github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pkg/captcha
|
|
|
|
linters:
|
|
enable-all: true
|
|
disable:
|
|
- sqlclosecheck # not relevant (SQL)
|
|
- rowserrcheck # not relevant (SQL)
|
|
- cyclop # duplicate of gocyclo
|
|
- bodyclose # Too many false positives: https://github.com/timakin/bodyclose/issues/30
|
|
- dupl
|
|
- testpackage
|
|
- tparallel
|
|
- paralleltest
|
|
- nlreturn
|
|
- wsl
|
|
- exhaustive
|
|
- exhaustruct
|
|
- err113
|
|
- wrapcheck
|
|
- noctx
|
|
- lll
|
|
- forbidigo
|
|
- varnamelen
|
|
- wastedassign # is disabled because of generics
|
|
- gofumpt
|
|
- gci
|
|
- mnd
|
|
- exportloopref
|
|
- contextcheck
|
|
issues:
|
|
exclude-use-default: false
|
|
max-same-issues: 0
|
|
exclude:
|
|
- "G402: TLS InsecureSkipVerify may be true."
|
|
exclude-rules:
|
|
- path: (.+)_test.go
|
|
linters:
|
|
- goconst
|
|
- funlen
|
|
- godot
|