search

Alice52 / go-tutorial

This repository records golang learning process
MIT License
0 stars 0 forks source link

fix(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] #7

Closed renovate[bot] closed 6 months ago

renovate[bot] commented 6 months ago

Mend Renovate

This PR contains the following updates:

Package Type Update Change
github.com/gin-gonic/gin require minor v1.8.1 -> v1.9.1

GitHub Vulnerability Alerts

CVE-2023-26125

Versions of the package github.com/gin-gonic/gin before version 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning.

Note: Although this issue does not pose a significant threat on its own it can serve as an input vector for other more impactful vulnerabilities. However, successful exploitation may depend on the server configuration and whether the header is used in the application logic.

CVE-2023-29401

The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat";x=.txt" will be sent as a file named "setup.bat".

If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.

Release Notes

gin-gonic/gin (github.com/gin-gonic/gin) ### [`v1.9.1`](https://togithub.com/gin-gonic/gin/blob/HEAD/CHANGELOG.md#Gin-v191) [Compare Source](https://togithub.com/gin-gonic/gin/compare/v1.9.0...v1.9.1) ##### BUG FIXES - fix Request.Context() checks [#​3512](https://togithub.com/gin-gonic/gin/pull/3512) ##### SECURITY - fix lack of escaping of filename in Content-Disposition [#​3556](https://togithub.com/gin-gonic/gin/pull/3556) ##### ENHANCEMENTS - refactor: use bytes.ReplaceAll directly [#​3455](https://togithub.com/gin-gonic/gin/pull/3455) - convert strings and slices using the officially recommended way [#​3344](https://togithub.com/gin-gonic/gin/pull/3344) - improve render code coverage [#​3525](https://togithub.com/gin-gonic/gin/pull/3525) ##### DOCS - docs: changed documentation link for trusted proxies [#​3575](https://togithub.com/gin-gonic/gin/pull/3575) - chore: improve linting, testing, and GitHub Actions setup [#​3583](https://togithub.com/gin-gonic/gin/pull/3583) ### [`v1.9.0`](https://togithub.com/gin-gonic/gin/blob/HEAD/CHANGELOG.md#Gin-v190) [Compare Source](https://togithub.com/gin-gonic/gin/compare/v1.8.2...v1.9.0) ##### BREAK CHANGES - Stop useless panicking in context and render [#​2150](https://togithub.com/gin-gonic/gin/pull/2150) ##### BUG FIXES - fix(router): tree bug where loop index is not decremented. [#​3460](https://togithub.com/gin-gonic/gin/pull/3460) - fix(context): panic on NegotiateFormat - index out of range [#​3397](https://togithub.com/gin-gonic/gin/pull/3397) - Add escape logic for header [#​3500](https://togithub.com/gin-gonic/gin/pull/3500) and [#​3503](https://togithub.com/gin-gonic/gin/pull/3503) ##### SECURITY - Fix the GO-2022-0969 and GO-2022-0288 vulnerabilities [#​3333](https://togithub.com/gin-gonic/gin/pull/3333) - fix(security): vulnerability GO-2023-1571 [#​3505](https://togithub.com/gin-gonic/gin/pull/3505) ##### ENHANCEMENTS - feat: add sonic json support [#​3184](https://togithub.com/gin-gonic/gin/pull/3184) - chore(file): Creates a directory named path [#​3316](https://togithub.com/gin-gonic/gin/pull/3316) - fix: modify interface check way [#​3327](https://togithub.com/gin-gonic/gin/pull/3327) - remove deprecated of package io/ioutil [#​3395](https://togithub.com/gin-gonic/gin/pull/3395) - refactor: avoid calling strings.ToLower twice [#​3343](https://togithub.com/gin-gonic/gin/pull/3433) - console logger HTTP status code bug fixed [#​3453](https://togithub.com/gin-gonic/gin/pull/3453) - chore(yaml): upgrade dependency to v3 version [#​3456](https://togithub.com/gin-gonic/gin/pull/3456) - chore(router): match method added to routergroup for multiple HTTP methods supporting [#​3464](https://togithub.com/gin-gonic/gin/pull/3464) - chore(http): add support for go1.20 http.rwUnwrapper to gin.responseWriter [#​3489](https://togithub.com/gin-gonic/gin/pull/3489) ##### DOCS - docs: update markdown format [#​3260](https://togithub.com/gin-gonic/gin/pull/3260) - docs(readme): Add the TOML rendering example [#​3400](https://togithub.com/gin-gonic/gin/pull/3400) - docs(readme): move more example to docs/doc.md [#​3449](https://togithub.com/gin-gonic/gin/pull/3449) - docs: update markdown format [#​3446](https://togithub.com/gin-gonic/gin/pull/3446) ### [`v1.8.2`](https://togithub.com/gin-gonic/gin/blob/HEAD/CHANGELOG.md#Gin-v182) [Compare Source](https://togithub.com/gin-gonic/gin/compare/v1.8.1...v1.8.2) ##### BUG FIXES - fix(route): redirectSlash bug (https://togithub.com/gin-gonic/gin/pull/3227)ic/gin/pull/3227\))) - fix(engine): missing route params for CreateTestContext (https://togithub.com/gin-gonic/gin/pull/2778)ic/gin/pull/2778\))) (https://togithub.com/gin-gonic/gin/pull/2803)ic/gin/pull/2803\))) ##### SECURITY - Fix the GO-2022-1144 vulnerability (https://togithub.com/gin-gonic/gin/pull/3432)ic/gin/pull/3432\)))

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Mend Renovate. View repository job log here.