Commit d634672
Eric Bower
·
2026-05-05 21:05:27 -0400 EDT
parent 83a5183
fix(auth): mime type can include charset e.g. text/html; charset=utf-8
3 files changed,
+16,
-7
M
go.mod
+1,
-1
| ... | ... | @@ -50,7 +50,7 @@ require ( | |
| 50 | 50 | github.com/simplesurance/go-ip-anonymizer v0.0.0-20200429124537-35a880f8e87d | |
| 51 | 51 | github.com/testcontainers/testcontainers-go v0.40.0 | |
| 52 | 52 | github.com/testcontainers/testcontainers-go/modules/postgres v0.40.0 | |
| 53 | - | github.com/x-way/crawlerdetect v0.2.30 | |
| 53 | + | github.com/x-way/crawlerdetect v0.2.31-0.20260212224137-1c21876d88a2 | |
| 54 | 54 | github.com/yuin/goldmark v1.8.2 | |
| 55 | 55 | github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc | |
| 56 | 56 | github.com/yuin/goldmark-meta v1.1.0 |
M
go.sum
+2,
-2
| ... | ... | @@ -328,8 +328,8 @@ github.com/tklauser/go-sysconf v0.3.15 h1:VE89k0criAymJ/Os65CSn1IXaol+1wrsFHEB8O | |
| 328 | 328 | github.com/tklauser/go-sysconf v0.3.15/go.mod h1:Dmjwr6tYFIseJw7a3dRLJfsHAMXZ3nEnL/aZY+0IuI4= | |
| 329 | 329 | github.com/tklauser/numcpus v0.10.0 h1:18njr6LDBk1zuna922MgdjQuJFjrdppsZG60sHGfjso= | |
| 330 | 330 | github.com/tklauser/numcpus v0.10.0/go.mod h1:BiTKazU708GQTYF4mB+cmlpT2Is1gLk7XVuEeem8LsQ= | |
| 331 | - | github.com/x-way/crawlerdetect v0.2.30 h1:U43R8+TZ7AZwBZehWRPdRdW53NmPoVZSOptevJKo1mE= | |
| 332 | - | github.com/x-way/crawlerdetect v0.2.30/go.mod h1:BPHLsB3FOuiwoWyhAvnqeiUSAEKd34O7BcsTCcxHRj4= | |
| 331 | + | github.com/x-way/crawlerdetect v0.2.31-0.20260212224137-1c21876d88a2 h1:ssAyb7n/6TPLWUVuVbGfzky4/ECJuIGmktDBawNZPv8= | |
| 332 | + | github.com/x-way/crawlerdetect v0.2.31-0.20260212224137-1c21876d88a2/go.mod h1:BPHLsB3FOuiwoWyhAvnqeiUSAEKd34O7BcsTCcxHRj4= | |
| 333 | 333 | github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= | |
| 334 | 334 | github.com/yuin/goldmark v1.4.15/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= | |
| 335 | 335 | github.com/yuin/goldmark v1.8.2 h1:kEGpgqJXdgbkhcOgBxkC0X0PmoPG1ZyoZ117rDVp4zE= |
+13,
-4
| ... | ... | @@ -682,6 +682,11 @@ func deserializeCaddyAccessLog(dbpool db.DB, access *AccessLog) (*db.AnalyticsVi | |
| 682 | 682 | subdomain = router.GetCustomDomain(host, space) | |
| 683 | 683 | } | |
| 684 | 684 | ||
| 685 | + | // skip requests to the base domain itself (e.g. prose.sh, tuns.sh, pgs.sh) | |
| 686 | + | if subdomain == "" { | |
| 687 | + | return nil, fmt.Errorf("request to base domain %s", host) | |
| 688 | + | } | |
| 689 | + | ||
| 685 | 690 | subdomain = strings.TrimSuffix(subdomain, ".nue") | |
| 686 | 691 | subdomain = strings.TrimSuffix(subdomain, ".ash") | |
| 687 | 692 |
| ... | ... | @@ -747,10 +752,17 @@ func accessLogToVisit(dbpool db.DB, line string) (*db.AnalyticsVisits, error) { | |
| 747 | 752 | return nil, fmt.Errorf("could not unmarshal line: %w", err) | |
| 748 | 753 | } | |
| 749 | 754 | ||
| 755 | + | contentType := strings.Join(accessLog.RespHeaders.ContentType, " ") | |
| 756 | + | baseMimeType := strings.TrimSpace(strings.SplitN(contentType, ";", 2)[0]) | |
| 757 | + | if !slices.Contains(allowedMime, baseMimeType) { | |
| 758 | + | return nil, fmt.Errorf("content type %q not allowed", baseMimeType) | |
| 759 | + | } | |
| 760 | + | ||
| 750 | 761 | return deserializeCaddyAccessLog(dbpool, &accessLog) | |
| 751 | 762 | } | |
| 752 | 763 | ||
| 753 | 764 | var allowedMime = []string{ | |
| 765 | + | "application/atom+xml", | |
| 754 | 766 | "application/gzip", | |
| 755 | 767 | "application/vnd.rar", | |
| 756 | 768 | "application/x-7z-compressed", |
| ... | ... | @@ -758,6 +770,7 @@ var allowedMime = []string{ | |
| 758 | 770 | "application/x-bzip2", | |
| 759 | 771 | "application/x-freearc", | |
| 760 | 772 | "application/x-tar", | |
| 773 | + | "application/xml", | |
| 761 | 774 | "application/zip", | |
| 762 | 775 | "text/html", | |
| 763 | 776 | } |
| ... | ... | @@ -791,10 +804,6 @@ func metricDrainSub(ctx context.Context, dbpool db.DB, logger *slog.Logger, secr | |
| 791 | 804 | continue | |
| 792 | 805 | } | |
| 793 | 806 | ||
| 794 | - | if !slices.Contains(allowedMime, visit.ContentType) { | |
| 795 | - | continue | |
| 796 | - | } | |
| 797 | - | ||
| 798 | 807 | logger.Info("inserting visit", "visit", visit) | |
| 799 | 808 | err = dbpool.InsertVisit(visit) | |
| 800 | 809 | if err != nil { |