Update module github.com/gofiber/fiber/v2 to v2.50.0 [SECURITY] - autoclosed #45
+1
−1
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.28.0
->v2.50.0
GitHub Vulnerability Alerts
CVE-2018-20744
The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.
CVE-2023-41338
Impact
This vulnerability can be categorized as a security misconfiguration. It impacts users of our project who rely on the ctx.IsFromLocal() method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost.
In it's implementation it uses c.IPs():
Thereby, setting
X-Forwarded-For: 127.0.0.1
in a request from a foreign host, will result in true for ctx.IsFromLocal()Patches
This issue has been patched in
v2.49.2
with commit b8c9ede6efa231116c4bd8bb9d5e03eac1cb76dcWorkarounds
Currently, there are no known workarounds to remediate this vulnerability without upgrading to the patched version. We strongly advise users to apply the patch as soon as it is released.
References
For further information and context regarding this security issue, please refer to the following resources:
CVE-2023-45128
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to inject arbitrary values without any authentication, or perform various malicious actions on behalf of an authenticated user, potentially compromising the security and integrity of the application.
Vulnerability Details
The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. The following issues were identified:
Token Injection: For 'safe' methods, the token was extracted from the cookie and saved to storage without further validation or sanitization.
Lack of Token Association: The CSRF token was validated against tokens in storage but not associated with a session, nor by using a Double Submit Cookie Method, allowing for token reuse.
Specific Go Packages Affected
github.com/gofiber/fiber/v2/middleware/csrf
Remediation
To remediate this vulnerability, it is recommended to take the following actions:
Update the Application: Upgrade the application to a fixed version with a patch for the vulnerability.
Implement Proper CSRF Protection: Review the updated documentation and ensure your application's CSRF protection mechanisms follow best practices.
Choose CSRF Protection Method: Select the appropriate CSRF protection method based on your application's requirements, either the Double Submit Cookie method or the Synchronizer Token Pattern using sessions.
Security Testing: Conduct a thorough security assessment, including penetration testing, to identify and address any other security vulnerabilities.
Defence-in-depth
Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes.
CVE-2023-45141
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the user's behalf, potentially compromising the security and integrity of the application.
Vulnerability Details
The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. The following issues were identified:
Specific Go Packages Affected
github.com/gofiber/fiber/v2/middleware/csrf
Remediation
To remediate this vulnerability, it is recommended to take the following actions:
Update the Application: Upgrade the application to a fixed version with a patch for the vulnerability.
Implement Proper CSRF Protection: Review the updated documentation and ensure your application's CSRF protection mechanisms follow best practices.
Choose CSRF Protection Method: Select the appropriate CSRF protection method based on your application's requirements, either the Double Submit Cookie method or the Synchronizer Token Pattern using sessions.
Security Testing: Conduct a thorough security assessment, including penetration testing, to identify and address any other security vulnerabilities.
Defence-in-depth
Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes.
Release Notes
gofiber/fiber (github.com/gofiber/fiber/v2)
v2.50.0
Compare Source
❗ Breaking Changes
👮 Security
Middleware/csrf: Token Vulnerability (GHSA-mv73-f69x-444p, GHSA-94w9-97p3-p368)
https://docs.gofiber.io/api/middleware/csrf
🚀 Improvements to the CSRF middleware:
SingleUseToken
configuration option.Session
andSessionKey
configuration options.Session
.Thank you @sixcolors
🚀 New
https://docs.gofiber.io/api/ctx#cookieparser
https://docs.gofiber.io/api/middleware/cors#config
https://docs.gofiber.io/api/middleware/session#signatures
Example usage:
https://docs.gofiber.io/api/middleware/session#signatures
Example usage:
🧹 Updates
🛠️ Maintenance
🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.49.2...v2.50.0
Thank you @KaptinLin, @Skyenought, @cuipeiyu, @dairlair, @efectn, @gaby, @geerew, @huykn, @jimmyl02, @joey1123455, @joshlarsen, @jscappini, @peczenyj and @sixcolors for making this update possible.
v2.49.2
Compare Source
🧹 Updates
🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.49.1...v2.49.2
Thank you @11-aryan and @AKARSHITJOSHI for making this update possible.
v2.49.1
Compare Source
🧹 Updates
🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.49.0...v2.49.1
Thank you @KompocikDot, @LimJiAn and @gaby for making this update possible.
v2.49.0
Compare Source
❗ Breaking Changes
https://docs.gofiber.io/api/fiber#config
🚀 New
https://docs.gofiber.io/api/middleware/favicon#config
🧹 Updates
errors.Is
instead ofos.IsNotExist
(#2558)🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.48.0...v2.49.0
Thank you @Jictyvoo, @Juneezee, @Kirari04, @LimJiAn, @PassTheMayo, @andersonmiranda-com, @bigpreshy, @efectn, @renanbastos93, @scandar, @sixcolors and @stefanb for making this update possible.
v2.48.0
Compare Source
🚀 New
https://docs.gofiber.io/guide/hooks#onlisten
https://docs.gofiber.io/api/log
🧹 Updates
🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.47.0...v2.48.0
Thank you @ForAeons, @RHeynsZa, @Saman-Safaei, @Skyenought, @Z3NTL3, @andre-dasilva, @cmd777, @dozheiny, @efectn, @f1rstmehul, @gaby, @itcuihao and @mo1ein for making this update possible.
v2.47.0
Compare Source
🚀 New
https://docs.gofiber.io/api/ctx#queries
https://docs.gofiber.io/api/middleware/logger#config
🧹 Updates
🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.46.0...v2.47.0
Thank you @Kamandlou, @Satont, @Skyenought, @cmd777, @dozheiny, @efectn, @gaby, @kaazedev, @luk3skyw4lker, @obakumen, @sixcolors and @ytsruh for making this update possible.
v2.46.0
Compare Source
🚀 New
🧹 Updates
https://docs.gofiber.io/category/-middleware
🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.45.0...v2.46.0
Thank you @alekseikovrigin, @efectn and @leonklingele for making this update possible.
v2.45.0
Compare Source
🚀 New
https://docs.gofiber.io/api/middleware/filesystem#default-config
🧹 Updates
🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.44.0...v2.45.0
Thank you @Jamess-Lucass, @baichangda, @carmeloriolo, @kanansnote and @kousikmitra for making this update possible.
v2.44.0
Compare Source
🚀 New
https://docs.gofiber.io/api/middleware/cors#config
👮 Security hint
Note: Using this feature is discouraged in production and it's best practice to explicitly set CORS origins via AllowOrigins.
In this example any origin will be allowed via CORS.
For example, if a browser running on http://localhost:3000 sends a request, this will be accepted and the access-control-allow-origin response header will be set to http://localhost:3000.
https://docs.gofiber.io/api/app#server-shutdown
🧹 Updates
🐛 Fixes
https://docs.gofiber.io/next/api/middleware/timeout
❗With version v2.38.1 we changed the behavior of the timeout function, this has now been undone and a function for use with context has been provided
❗The fallback value for not found or not boolean values was adjusted to the golang standard
📚 Documentation
Full Changelog: gofiber/fiber@v2.43.0...v2.44.0
Thank you @Jamess-Lucass, @ancogamer, @cmd777, @dozheiny, @eld4niz, @hakankutluay, @jcyamacho, @leonklingele and @shahriarsohan for making this update possible.
v2.43.0
Compare Source
❗ BreakingChange
Due to the fact that fasthttp, which fiber is based on in release 1.45.0, does not support go version 1.16 anymore, we had to remove it from our package as well.
🚀 New
https://docs.gofiber.io/api/app#listentlswithcertificate
https://docs.gofiber.io/api/app#listenmutualtlswithcertificate
https://docs.gofiber.io/api/ctx#querybool
https://docs.gofiber.io/api/ctx#queryfloat
https://docs.gofiber.io/api/middleware/session
https://docs.gofiber.io/api/middleware/proxy
🧹 Updates
🐛 Fixes
📚 Documentation
gofiber/docs
(#2344)Full Changelog: gofiber/fiber@v2.42.0...v2.43.0
Thank you @CaioAugustoo, @HHongSeungWoo, @IwateKyle, @Rorke76753, @Skyenought, @UtopiaGitHub, @benjajaja, @derkan, @dozheiny, @efectn, @gaby, @leonklingele, @lublak, @msaf1980, @ryand67 and @yvestumushimire for making this update possible.
v2.42.0
Compare Source
🚀 New
https://docs.gofiber.io/api/ctx#queryint
https://docs.gofiber.io/api/middleware/earlydata
https://docs.gofiber.io/api/middleware/idempotency
https://docs.gofiber.io/api/middleware/proxy
🧹 Updates/CI
https://docs.gofiber.io/api/middleware/favicon
🐛 Fixes
app.getString, app.GetBytes
instead ofutils.UnsafeString, utils.UnsafeBytes
inctx.go
(#2297)📚 Documentation
Full Changelog: gofiber/fiber@v2.41.0...v2.42.0
Thank you @0xdeface, @100gle, @TwiN, @cloudwindy, @dozheiny, @efectn, @leonklingele, @meehow, @pan93412, @rendiputra and @rhabichl for making this update possible.
v2.41.0
Compare Source
🚀 New
https://docs.gofiber.io/api/app#server-shutdown
https://pkg.go.dev/github.com/gofiber/fiber/v2#RoutePatternMatch
🧹 Updates
🐛 Fixes
📚 Documentation
1.14
with1.16
in READMEs (#2265)Full Changelog: gofiber/fiber@v2.40.1...v2.41.0
Thank you @AngelVI13, @Simerax, @cwinters8, @efectn, @jfcg, @leonklingele, @li-jin-gou, @pjebs, @shuuji3 and @v1def for making this update possible.
v2.40.1
Compare Source
🐛 Fixes
/
(#2227)Full Changelog: gofiber/fiber@v2.40.0...v2.40.1
v2.40.0
Compare Source
❗ BreakingChange
Due to the fact that fasthttp, which fiber is based on in release 1.41.0, does not support go versions 1.14 & 1.15 anymore, we had to remove them from our package as well.
🚀 New
https://docs.gofiber.io/api/fiber#config
https://docs.gofiber.io/api/app#route-handlers - More like Express
https://docs.gofiber.io/guide/routing#constraints
https://docs.gofiber.io/api/app#mount https://docs.gofiber.io/api/app#mountpath
https://docs.gofiber.io/api/middleware/pprof
https://docs.gofiber.io/api/middleware/logger#add-custom-tags
https://docs.gofiber.io/api/middleware/logger#callback-after-log-is-written
🧹 Updates
🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.39.0...v2.40.0
Thank you @Skyenought, @calebcase, @efectn, @gandaldf, @gmlewis, @jamestiotio, @leonklingele, @li-jin-gou, @marcmartin13, @panjf2000, @pjebs, @rafimuhammad01 and @thor-son for making this update possible.
v2.39.0
Compare Source
🚀 New
https://docs.gofiber.io/api/middleware/cache
https://docs.gofiber.io/api/middleware/proxy
https://docs.gofiber.io/api/app#getroutes
https://docs.gofiber.io/api/app#static
🧹 Updates
🐛 Fixes
📚 Documentation
Full Changelog: gofiber/fiber@v2.38.1...v2.39.0
Thank you @Kamandlou, @Yureien, @efectn, @floxydio, @fufuok, @joseroberto, @leonklingele, @li-jin-gou, @marcmartin13, @nathanfaucett, @sadfun, @supakornbabe, @unickorn and @xbt573 for making this update possible.
v2.38.1
Compare Source
🚀 New
https://docs.gofiber.io/api/middleware/cache
🧹 Updates
https://docs.gofiber.io/api/middleware/timeout
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.