lukaszraczylo/traefik-llmgateway
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/traefik-llmgateway.git synced 2026-10-19 05:47:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: escape request path in auth event logs

Browse Source 
logAuthEvent (logger.go) formatted r.URL.Path with %s in both the
failure and success log lines. An unauthenticated client controls that
path and can embed a raw newline (%0A) in it, letting a single request
forge additional, attacker-chosen log lines. Switched both to %q, which
escapes control characters (newlines included) while still rendering
the path as a quoted string.

No test changes needed: both existing tests (llmgateway_test.go) assert
via strings.Contains on the bare path substring, which %q's quoted
output still contains.

Gates: go test ./... -count=1 green, gofmt -l . empty, go vet clean.
This commit is contained in:
lukaszraczylo
2026-08-20 15:06:34 +01:00
parent c9ae14adf7
commit 90bb837a5d
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
logger.go
+2 -2
View File
@@ -27,10 +27,10 @@ func (g *Gateway) errorf(format string, args ...any) {
// key it authenticated. // key it authenticated.
func (g *Gateway) logAuthEvent(ok bool, userName string, r *http.Request) { func (g *Gateway) logAuthEvent(ok bool, userName string, r *http.Request) {
if !ok { if !ok {
g.logf("auth failed: %s %s from %s", r.Method, r.URL.Path, r.RemoteAddr) g.logf("auth failed: %s %q from %s", r.Method, r.URL.Path, r.RemoteAddr)
return return
} }
g.logf("auth ok: user %q %s %s", userName, r.Method, r.URL.Path) g.logf("auth ok: user %q %s %q", userName, r.Method, r.URL.Path)
} }
// authEventUserName extracts u's name for logAuthEvent's userName // authEventUserName extracts u's name for logAuthEvent's userName