mixandClaude Opus 5.5
5210cb19f2
Security audit 2026-10-17, finding A4 (low), stage 0. The line logged when a request carries two unprefixed session cookies printed r.URL.Path raw, so GET /confirm/<token> wrote the token to the log (reachable only with PANEL_COOKIE_SECURE=false, where a sibling host can plant the bare name). loggedPath moves from internal/web to internal/web/auth as LoggedPath (web imports auth, not the other way) and both lines - the origin check's refusal and the duplicate-cookie one - go through it. Tests: TestDuplicateCookieLineHidesALinksToken; TestLoggedPathHidesTokens moved with the function. go test ./internal/web ./internal/web/auth. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
20 lines
562 B
Go
20 lines
562 B
Go
package auth
|
|
|
|
import "testing"
|
|
|
|
// A rejected request's path is logged without the token of a link
|
|
// (security review, 2026-10-17).
|
|
func TestLoggedPathHidesTokens(t *testing.T) {
|
|
for in, want := range map[string]string{
|
|
"/login/reset/abcDEF123": "/login/reset/…",
|
|
"/confirm/abcDEF123": "/confirm/…",
|
|
"/login/reset": "/login/reset",
|
|
"/confirm/": "/confirm/",
|
|
"/account/profile": "/account/profile",
|
|
} {
|
|
if got := LoggedPath(in); got != want {
|
|
t.Errorf("LoggedPath(%q) = %q, want %q", in, got, want)
|
|
}
|
|
}
|
|
}
|