You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@dubbo.apache.org by GitBox <gi...@apache.org> on 2021/10/17 11:53:52 UTC
[GitHub] [dubbo-go-pixiu] baerwang opened a new pull request #282: add:csrf
baerwang opened a new pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282
<!-- Thanks for sending a pull request!
-->
**What this PR does**:
**Which issue(s) this PR fixes**:
<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
_If PR is about `failing-tests or flakes`, please post the related issues/tests in a comment and do not use `Fixes`_*
-->
Fixes #
**Special notes for your reviewer**:
**Does this PR introduce a user-facing change?**:
<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".
-->
```release-note
NONE
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go-pixiu] codecov-commenter edited a comment on pull request #282: add:csrf
Posted by GitBox <gi...@apache.org>.
codecov-commenter edited a comment on pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282#issuecomment-945101488
# [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) Report
> Merging [#282](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (d6a90fb) into [develop](https://codecov.io/gh/apache/dubbo-go-pixiu/commit/3f188337bca8455c7c8a8b53f05f74f678cc0256?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (3f18833) will **not change** coverage.
> The diff coverage is `n/a`.
[](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
```diff
@@ Coverage Diff @@
## develop #282 +/- ##
========================================
Coverage 33.14% 33.14%
========================================
Files 62 62
Lines 3322 3322
========================================
Hits 1101 1101
Misses 2107 2107
Partials 114 114
```
------
[Continue to review full report at Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Last update [3f18833...d6a90fb](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go-pixiu] MasterKenway commented on a change in pull request #282: add:csrf
Posted by GitBox <gi...@apache.org>.
MasterKenway commented on a change in pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282#discussion_r735265995
##########
File path: pkg/filter/csrf/csrf.go
##########
@@ -0,0 +1,144 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package csrf
+
+import (
+ "encoding/base64"
+ "encoding/json"
+ "fmt"
+ http2 "net/http"
+)
Review comment:
what about use `stdHttp` stands for "standardHttp", http2 is quite confusing
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go-pixiu] codecov-commenter edited a comment on pull request #282: add:csrf
Posted by GitBox <gi...@apache.org>.
codecov-commenter edited a comment on pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282#issuecomment-945101488
# [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) Report
> Merging [#282](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (dfa03fc) into [develop](https://codecov.io/gh/apache/dubbo-go-pixiu/commit/27066a5e21ce287722e657fc77ffe58c7d219815?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (27066a5) will **not change** coverage.
> The diff coverage is `n/a`.
[](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
```diff
@@ Coverage Diff @@
## develop #282 +/- ##
========================================
Coverage 33.13% 33.13%
========================================
Files 62 62
Lines 3323 3323
========================================
Hits 1101 1101
Misses 2108 2108
Partials 114 114
```
------
[Continue to review full report at Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Last update [27066a5...dfa03fc](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go-pixiu] MasterKenway commented on a change in pull request #282: add:csrf
Posted by GitBox <gi...@apache.org>.
MasterKenway commented on a change in pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282#discussion_r735265995
##########
File path: pkg/filter/csrf/csrf.go
##########
@@ -0,0 +1,144 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package csrf
+
+import (
+ "encoding/base64"
+ "encoding/json"
+ "fmt"
+ http2 "net/http"
+)
Review comment:
what about use `stdHttp` stand for "standardHttp", http2 is quite confusing
##########
File path: pkg/filter/csrf/csrf.go
##########
@@ -0,0 +1,144 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package csrf
+
+import (
+ "encoding/base64"
+ "encoding/json"
+ "fmt"
+ http2 "net/http"
+)
+
+import (
+ "github.com/apache/dubbo-go-pixiu/pkg/common/constant"
+ "github.com/apache/dubbo-go-pixiu/pkg/common/extension/filter"
+ "github.com/apache/dubbo-go-pixiu/pkg/context/http"
+)
+
+const (
+ // Kind is the kind of Fallback.
+ Kind = constant.HTTPCsrfFilter
+)
+
+const (
+ csrfSecret = "csrfSecret"
+ csrfSalt = "csrfSalt"
+)
+
+func init() {
+ filter.RegisterHttpFilter(&Plugin{})
+}
+
+type (
+ // Plugin is http filter plugin.
+ Plugin struct {
+ }
+
+ // Filter is http filter instance
+ Filter struct {
+ cfg *Config
+ }
+
+ // Config describe the config of Filter
+ Config struct {
+ Key string `yaml:"key" json:"key" mapstructure:"key"` // get request key
+ Secret string `yaml:"secret" json:"secret" mapstructure:"secret"` // private key
+ ErrorMsg string `yaml:"error_msg" json:"error_msg" mapstructure:"error_msg"` // hint error info
+ IgnoreMethods []string `yaml:"ignore_methods" json:"ignore_methods" mapstructure:"ignore_methods"` // ignore request method
+ }
+)
+
+func (p *Plugin) Kind() string {
+ return Kind
+}
+
+func (p *Plugin) CreateFilter() (filter.HttpFilter, error) {
+ return &Filter{cfg: &Config{}}, nil
+}
+
+func (f *Filter) PrepareFilterChain(ctx *http.HttpContext) error {
+ ctx.AppendFilterFunc(f.Handle)
+ return nil
+}
+
+func (f *Filter) Handle(ctx *http.HttpContext) {
+ f.handleCsrf(ctx)
+}
+
+func (f *Filter) handleCsrf(ctx *http.HttpContext) {
+ ctx.Request.Header.Set(csrfSecret, f.cfg.Secret)
+
+ if inMethod(f.cfg.IgnoreMethods, ctx.Request.Method) {
Review comment:
My opinion is handle error as early as you can, so make it more efficient
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go-pixiu] baerwang commented on a change in pull request #282: add:csrf
Posted by GitBox <gi...@apache.org>.
baerwang commented on a change in pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282#discussion_r730552708
##########
File path: pkg/filter/csrf/csrf.go
##########
@@ -0,0 +1,144 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package csrf
+
+import (
+ "encoding/base64"
+ "encoding/json"
+ "fmt"
+ http2 "net/http"
+)
+
+import (
+ "github.com/apache/dubbo-go-pixiu/pkg/common/constant"
+ "github.com/apache/dubbo-go-pixiu/pkg/common/extension/filter"
+ "github.com/apache/dubbo-go-pixiu/pkg/context/http"
+)
+
+const (
+ // Kind is the kind of Fallback.
+ Kind = constant.HTTPCsrfFilter
+)
+
+const (
+ csrfSecret = "csrfSecret"
+ csrfSalt = "csrfSalt"
+)
+
+func init() {
+ filter.RegisterHttpFilter(&Plugin{})
+}
+
+type (
+ // Plugin is http filter plugin.
+ Plugin struct {
+ }
+
+ // Filter is http filter instance
+ Filter struct {
+ cfg *Config
+ }
+
+ // Config describe the config of Filter
+ Config struct {
+ Key string `yaml:"key" json:"key" mapstructure:"key"` // get request key
+ Secret string `yaml:"secret" json:"secret" mapstructure:"secret"` // private key
+ ErrorMsg string `yaml:"error_msg" json:"error_msg" mapstructure:"error_msg"` // hint error info
+ IgnoreMethods []string `yaml:"ignore_methods" json:"ignore_methods" mapstructure:"ignore_methods"` // ignore request method
+ }
+)
+
+func (p *Plugin) Kind() string {
+ return Kind
+}
+
+func (p *Plugin) CreateFilter() (filter.HttpFilter, error) {
+ return &Filter{cfg: &Config{}}, nil
+}
+
+func (f *Filter) PrepareFilterChain(ctx *http.HttpContext) error {
+ ctx.AppendFilterFunc(f.Handle)
+ return nil
+}
+
+func (f *Filter) Handle(ctx *http.HttpContext) {
+ f.handleCsrf(ctx)
+}
+
+func (f *Filter) handleCsrf(ctx *http.HttpContext) {
+ ctx.Request.Header.Set(csrfSecret, f.cfg.Secret)
+
+ if inMethod(f.cfg.IgnoreMethods, ctx.Request.Method) {
Review comment:
Filter a certain api request method, without auth
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go-pixiu] AlexStocks merged pull request #282: add:csrf
Posted by GitBox <gi...@apache.org>.
AlexStocks merged pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go-pixiu] zouyx commented on a change in pull request #282: add:csrf
Posted by GitBox <gi...@apache.org>.
zouyx commented on a change in pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282#discussion_r732529235
##########
File path: pkg/filter/csrf/csrf.go
##########
@@ -0,0 +1,144 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package csrf
+
+import (
+ "encoding/base64"
+ "encoding/json"
+ "fmt"
+ http2 "net/http"
+)
+
+import (
+ "github.com/apache/dubbo-go-pixiu/pkg/common/constant"
+ "github.com/apache/dubbo-go-pixiu/pkg/common/extension/filter"
+ "github.com/apache/dubbo-go-pixiu/pkg/context/http"
+)
+
+const (
+ // Kind is the kind of Fallback.
+ Kind = constant.HTTPCsrfFilter
+)
+
+const (
+ csrfSecret = "csrfSecret"
+ csrfSalt = "csrfSalt"
+)
+
+func init() {
+ filter.RegisterHttpFilter(&Plugin{})
+}
+
+type (
+ // Plugin is http filter plugin.
+ Plugin struct {
+ }
+
+ // Filter is http filter instance
+ Filter struct {
+ cfg *Config
+ }
+
+ // Config describe the config of Filter
+ Config struct {
+ Key string `yaml:"key" json:"key" mapstructure:"key"` // get request key
+ Secret string `yaml:"secret" json:"secret" mapstructure:"secret"` // private key
+ ErrorMsg string `yaml:"error_msg" json:"error_msg" mapstructure:"error_msg"` // hint error info
+ IgnoreMethods []string `yaml:"ignore_methods" json:"ignore_methods" mapstructure:"ignore_methods"` // ignore request method
+ }
+)
+
+func (p *Plugin) Kind() string {
+ return Kind
+}
+
+func (p *Plugin) CreateFilter() (filter.HttpFilter, error) {
+ return &Filter{cfg: &Config{}}, nil
+}
+
+func (f *Filter) PrepareFilterChain(ctx *http.HttpContext) error {
+ ctx.AppendFilterFunc(f.Handle)
+ return nil
+}
+
+func (f *Filter) Handle(ctx *http.HttpContext) {
+ f.handleCsrf(ctx)
+}
+
+func (f *Filter) handleCsrf(ctx *http.HttpContext) {
+ ctx.Request.Header.Set(csrfSecret, f.cfg.Secret)
+
+ if inMethod(f.cfg.IgnoreMethods, ctx.Request.Method) {
Review comment:
sorry..why did not check method first....
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go-pixiu] codecov-commenter edited a comment on pull request #282: add:csrf
Posted by GitBox <gi...@apache.org>.
codecov-commenter edited a comment on pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282#issuecomment-945101488
# [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) Report
> Merging [#282](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (1bee5a6) into [develop](https://codecov.io/gh/apache/dubbo-go-pixiu/commit/8080a476f38363ea779a54793e228e97003770f5?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (8080a47) will **not change** coverage.
> The diff coverage is `n/a`.
[](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
```diff
@@ Coverage Diff @@
## develop #282 +/- ##
========================================
Coverage 33.14% 33.14%
========================================
Files 62 62
Lines 3322 3322
========================================
Hits 1101 1101
Misses 2107 2107
Partials 114 114
```
------
[Continue to review full report at Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Last update [8080a47...1bee5a6](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go-pixiu] codecov-commenter edited a comment on pull request #282: add:csrf
Posted by GitBox <gi...@apache.org>.
codecov-commenter edited a comment on pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282#issuecomment-945101488
# [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) Report
> Merging [#282](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (7704016) into [develop](https://codecov.io/gh/apache/dubbo-go-pixiu/commit/8080a476f38363ea779a54793e228e97003770f5?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (8080a47) will **not change** coverage.
> The diff coverage is `n/a`.
[](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
```diff
@@ Coverage Diff @@
## develop #282 +/- ##
========================================
Coverage 33.14% 33.14%
========================================
Files 62 62
Lines 3322 3322
========================================
Hits 1101 1101
Misses 2107 2107
Partials 114 114
```
------
[Continue to review full report at Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Last update [8080a47...7704016](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go-pixiu] mark4z commented on pull request #282: add:csrf
Posted by GitBox <gi...@apache.org>.
mark4z commented on pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282#issuecomment-950325841
cc @MasterKenway
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go-pixiu] codecov-commenter edited a comment on pull request #282: add:csrf
Posted by GitBox <gi...@apache.org>.
codecov-commenter edited a comment on pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282#issuecomment-945101488
# [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) Report
> Merging [#282](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (1bee5a6) into [develop](https://codecov.io/gh/apache/dubbo-go-pixiu/commit/8080a476f38363ea779a54793e228e97003770f5?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (8080a47) will **not change** coverage.
> The diff coverage is `n/a`.
[](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
```diff
@@ Coverage Diff @@
## develop #282 +/- ##
========================================
Coverage 33.14% 33.14%
========================================
Files 62 62
Lines 3322 3322
========================================
Hits 1101 1101
Misses 2107 2107
Partials 114 114
```
------
[Continue to review full report at Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Last update [8080a47...1bee5a6](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go-pixiu] baerwang commented on a change in pull request #282: add:csrf
Posted by GitBox <gi...@apache.org>.
baerwang commented on a change in pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282#discussion_r730563573
##########
File path: samples/dubbogo/simple/csrf/test/pixiu_test.go
##########
@@ -0,0 +1,58 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package csrf
+
+import (
+ "github.com/stretchr/testify/assert"
Review comment:
ok
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go-pixiu] codecov-commenter edited a comment on pull request #282: add:csrf
Posted by GitBox <gi...@apache.org>.
codecov-commenter edited a comment on pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282#issuecomment-945101488
# [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) Report
> Merging [#282](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (191dbc7) into [develop](https://codecov.io/gh/apache/dubbo-go-pixiu/commit/8080a476f38363ea779a54793e228e97003770f5?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (8080a47) will **not change** coverage.
> The diff coverage is `n/a`.
[](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
```diff
@@ Coverage Diff @@
## develop #282 +/- ##
========================================
Coverage 33.14% 33.14%
========================================
Files 62 62
Lines 3322 3322
========================================
Hits 1101 1101
Misses 2107 2107
Partials 114 114
```
------
[Continue to review full report at Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Last update [8080a47...191dbc7](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go-pixiu] codecov-commenter edited a comment on pull request #282: add:csrf
Posted by GitBox <gi...@apache.org>.
codecov-commenter edited a comment on pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282#issuecomment-945101488
# [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) Report
> Merging [#282](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (084ed12) into [develop](https://codecov.io/gh/apache/dubbo-go-pixiu/commit/27066a5e21ce287722e657fc77ffe58c7d219815?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (27066a5) will **not change** coverage.
> The diff coverage is `n/a`.
[](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
```diff
@@ Coverage Diff @@
## develop #282 +/- ##
========================================
Coverage 33.13% 33.13%
========================================
Files 62 62
Lines 3323 3323
========================================
Hits 1101 1101
Misses 2108 2108
Partials 114 114
```
------
[Continue to review full report at Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Last update [27066a5...084ed12](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go-pixiu] baerwang commented on a change in pull request #282: add:csrf
Posted by GitBox <gi...@apache.org>.
baerwang commented on a change in pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282#discussion_r732775519
##########
File path: pkg/filter/csrf/csrf.go
##########
@@ -0,0 +1,144 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package csrf
+
+import (
+ "encoding/base64"
+ "encoding/json"
+ "fmt"
+ http2 "net/http"
+)
+
+import (
+ "github.com/apache/dubbo-go-pixiu/pkg/common/constant"
+ "github.com/apache/dubbo-go-pixiu/pkg/common/extension/filter"
+ "github.com/apache/dubbo-go-pixiu/pkg/context/http"
+)
+
+const (
+ // Kind is the kind of Fallback.
+ Kind = constant.HTTPCsrfFilter
+)
+
+const (
+ csrfSecret = "csrfSecret"
+ csrfSalt = "csrfSalt"
+)
+
+func init() {
+ filter.RegisterHttpFilter(&Plugin{})
+}
+
+type (
+ // Plugin is http filter plugin.
+ Plugin struct {
+ }
+
+ // Filter is http filter instance
+ Filter struct {
+ cfg *Config
+ }
+
+ // Config describe the config of Filter
+ Config struct {
+ Key string `yaml:"key" json:"key" mapstructure:"key"` // get request key
+ Secret string `yaml:"secret" json:"secret" mapstructure:"secret"` // private key
+ ErrorMsg string `yaml:"error_msg" json:"error_msg" mapstructure:"error_msg"` // hint error info
+ IgnoreMethods []string `yaml:"ignore_methods" json:"ignore_methods" mapstructure:"ignore_methods"` // ignore request method
+ }
+)
+
+func (p *Plugin) Kind() string {
+ return Kind
+}
+
+func (p *Plugin) CreateFilter() (filter.HttpFilter, error) {
+ return &Filter{cfg: &Config{}}, nil
+}
+
+func (f *Filter) PrepareFilterChain(ctx *http.HttpContext) error {
+ ctx.AppendFilterFunc(f.Handle)
+ return nil
+}
+
+func (f *Filter) Handle(ctx *http.HttpContext) {
+ f.handleCsrf(ctx)
+}
+
+func (f *Filter) handleCsrf(ctx *http.HttpContext) {
+ ctx.Request.Header.Set(csrfSecret, f.cfg.Secret)
+
+ if inMethod(f.cfg.IgnoreMethods, ctx.Request.Method) {
Review comment:
There is no need for this at all, even if the error message given by the user will not pass
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go-pixiu] codecov-commenter edited a comment on pull request #282: add:csrf
Posted by GitBox <gi...@apache.org>.
codecov-commenter edited a comment on pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282#issuecomment-945101488
# [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) Report
> Merging [#282](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (4e511a4) into [develop](https://codecov.io/gh/apache/dubbo-go-pixiu/commit/cb4a2538e4afc683e171c560991cb4ddd4350f1f?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (cb4a253) will **not change** coverage.
> The diff coverage is `n/a`.
> :exclamation: Current head 4e511a4 differs from pull request most recent head 2b84d8f. Consider uploading reports for the commit 2b84d8f to get more accurate results
[](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
```diff
@@ Coverage Diff @@
## develop #282 +/- ##
========================================
Coverage 33.13% 33.13%
========================================
Files 62 62
Lines 3323 3323
========================================
Hits 1101 1101
Misses 2108 2108
Partials 114 114
```
------
[Continue to review full report at Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Last update [cb4a253...2b84d8f](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go-pixiu] zouyx commented on a change in pull request #282: add:csrf
Posted by GitBox <gi...@apache.org>.
zouyx commented on a change in pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282#discussion_r730514542
##########
File path: pkg/filter/csrf/csrf.go
##########
@@ -0,0 +1,144 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package csrf
+
+import (
+ "encoding/base64"
+ "encoding/json"
+ "fmt"
+ http2 "net/http"
+)
+
+import (
+ "github.com/apache/dubbo-go-pixiu/pkg/common/constant"
+ "github.com/apache/dubbo-go-pixiu/pkg/common/extension/filter"
+ "github.com/apache/dubbo-go-pixiu/pkg/context/http"
+)
+
+const (
+ // Kind is the kind of Fallback.
+ Kind = constant.HTTPCsrfFilter
+)
+
+const (
+ csrfSecret = "csrfSecret"
+ csrfSalt = "csrfSalt"
+)
+
+func init() {
+ filter.RegisterHttpFilter(&Plugin{})
+}
+
+type (
+ // Plugin is http filter plugin.
+ Plugin struct {
+ }
+
+ // Filter is http filter instance
+ Filter struct {
+ cfg *Config
+ }
+
+ // Config describe the config of Filter
+ Config struct {
+ Key string `yaml:"key" json:"key" mapstructure:"key"` // get request key
+ Secret string `yaml:"secret" json:"secret" mapstructure:"secret"` // private key
+ ErrorMsg string `yaml:"error_msg" json:"error_msg" mapstructure:"error_msg"` // hint error info
+ IgnoreMethods []string `yaml:"ignore_methods" json:"ignore_methods" mapstructure:"ignore_methods"` // ignore request method
+ }
+)
+
+func (p *Plugin) Kind() string {
+ return Kind
+}
+
+func (p *Plugin) CreateFilter() (filter.HttpFilter, error) {
+ return &Filter{cfg: &Config{}}, nil
+}
+
+func (f *Filter) PrepareFilterChain(ctx *http.HttpContext) error {
+ ctx.AppendFilterFunc(f.Handle)
+ return nil
+}
+
+func (f *Filter) Handle(ctx *http.HttpContext) {
+ f.handleCsrf(ctx)
+}
+
+func (f *Filter) handleCsrf(ctx *http.HttpContext) {
+ ctx.Request.Header.Set(csrfSecret, f.cfg.Secret)
+
+ if inMethod(f.cfg.IgnoreMethods, ctx.Request.Method) {
Review comment:
why did you check method first?
##########
File path: samples/dubbogo/simple/csrf/test/pixiu_test.go
##########
@@ -0,0 +1,58 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package csrf
+
+import (
+ "github.com/stretchr/testify/assert"
Review comment:
format import pls
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go-pixiu] codecov-commenter commented on pull request #282: add:csrf
Posted by GitBox <gi...@apache.org>.
codecov-commenter commented on pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282#issuecomment-945101488
# [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) Report
> Merging [#282](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (154ad17) into [develop](https://codecov.io/gh/apache/dubbo-go-pixiu/commit/cb4a2538e4afc683e171c560991cb4ddd4350f1f?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (cb4a253) will **not change** coverage.
> The diff coverage is `n/a`.
[](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
```diff
@@ Coverage Diff @@
## develop #282 +/- ##
========================================
Coverage 33.13% 33.13%
========================================
Files 62 62
Lines 3323 3323
========================================
Hits 1101 1101
Misses 2108 2108
Partials 114 114
```
------
[Continue to review full report at Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Last update [cb4a253...154ad17](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-go-pixiu] codecov-commenter edited a comment on pull request #282: add:csrf
Posted by GitBox <gi...@apache.org>.
codecov-commenter edited a comment on pull request #282:
URL: https://github.com/apache/dubbo-go-pixiu/pull/282#issuecomment-945101488
# [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) Report
> Merging [#282](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (084ed12) into [develop](https://codecov.io/gh/apache/dubbo-go-pixiu/commit/27066a5e21ce287722e657fc77ffe58c7d219815?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (27066a5) will **not change** coverage.
> The diff coverage is `n/a`.
[](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
```diff
@@ Coverage Diff @@
## develop #282 +/- ##
========================================
Coverage 33.13% 33.13%
========================================
Files 62 62
Lines 3323 3323
========================================
Hits 1101 1101
Misses 2108 2108
Partials 114 114
```
------
[Continue to review full report at Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Last update [27066a5...084ed12](https://codecov.io/gh/apache/dubbo-go-pixiu/pull/282?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org