schwarzit.stackit-public/audit-go
1
0
Fork 0
mirror of https://dev.azure.com/schwarzit/schwarzit.stackit-public/_git/audit-go synced 2026-02-19 22:21:48 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merged PR 723917: fix: Filter grpcgateway-authorization headers

Browse source 
Security-concept-update-needed: false.

JIRA Work Item: STACKITALO-98
This commit is contained in:
Christian Schaible 2025-01-28 13:39:06 +00:00
parent 3472ce1585
commit 720a1a6d72
2 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
audit/api/model.go
View file

@ -582,12 +582,12 @@ func byteArrayToPbStruct(bytes []byte) (*structpb.Struct, error) {
} }
// FilterAndMergeHeaders filters ":authority", "Authorization", "B3" and "Host" headers as well as // FilterAndMergeHeaders filters ":authority", "Authorization", "B3" and "Host" headers as well as
// all headers starting with the prefixes "X-" and "STACKIT-". // all headers starting with the prefixes "X-", "STACKIT-" and "grpcgateway-".
// Headers are merged if there is more than one value for a given name. // Headers are merged if there is more than one value for a given name.
func FilterAndMergeHeaders(headers map[string][]string) map[string]string { func FilterAndMergeHeaders(headers map[string][]string) map[string]string {
var resultMap = make(map[string]string) var resultMap = make(map[string]string)
skipHeaders := []string{":authority", "authorization", "b3", "host"} skipHeaders := []string{":authority", "authorization", "b3", "host"}
skipPrefixHeaders := []string{"x-", "stackit-"} skipPrefixHeaders := []string{"x-", "stackit-", "grpcgateway-"}
if len(headers) == 0 { if len(headers) == 0 {
return nil return nil

1
audit/api/model_test.go
View file

@ -331,6 +331,7 @@ func Test_FilterAndMergeRequestHeaders(t *testing.T) {
headers := make(map[string][]string) headers := make(map[string][]string)
headers["X-Forwarded-Proto"] = []string{"https"} headers["X-Forwarded-Proto"] = []string{"https"}
headers["Stackit-test"] = []string{"test"} headers["Stackit-test"] = []string{"test"}
headers["grpcgateway-authorization"] = []string{userToken}
filteredHeaders := FilterAndMergeHeaders(headers) filteredHeaders := FilterAndMergeHeaders(headers)
assert.Equal(t, 0, len(filteredHeaders)) assert.Equal(t, 0, len(filteredHeaders))