sun
91b0c8acee
VUL-005 (低): 攻击者可在 HTTP 请求 URL 或上游错误响应中
注入 \n / \r 字符,伪造日志行干扰排障。无代码执行风险。
修复位置:
- middleware/logger.go: 访问日志中的 r.RequestURI 是未经
解析的原始请求行,客户端可控。转义 \n / \r 为字面字符
- adapter/volcano/synthesis.go: 上游非 200 响应体 (rawBody)
可能是攻击者控制的恶意内容,转义后再嵌入错误消息
33 lines
842 B
Go
33 lines
842 B
Go
package middleware
|
|
|
|
import (
|
|
"log"
|
|
"net/http"
|
|
"strings"
|
|
"time"
|
|
)
|
|
|
|
type statusRecorder struct {
|
|
http.ResponseWriter
|
|
statusCode int
|
|
}
|
|
|
|
func (rec *statusRecorder) WriteHeader(code int) {
|
|
rec.statusCode = code
|
|
rec.ResponseWriter.WriteHeader(code)
|
|
}
|
|
|
|
func Logger(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
start := time.Now()
|
|
rec := &statusRecorder{ResponseWriter: w, statusCode: http.StatusOK}
|
|
next.ServeHTTP(rec, r)
|
|
duration := time.Since(start)
|
|
|
|
// r.RequestURI 是未经解析的原始请求行,攻击者可在 URL 中注入
|
|
// \n / \r 伪造日志行。转义为可见字符后再记录。
|
|
uri := strings.NewReplacer("\n", "\\n", "\r", "\\r").Replace(r.RequestURI)
|
|
log.Printf("%s %s %s %d %v", r.Method, uri, r.RemoteAddr, rec.statusCode, duration)
|
|
})
|
|
}
|