r/golang

3d ago

u/RunSensitive567

Four ways my Go framework's router and access control read the same request path differently

I maintain melody, a Go framework for HTTP and CLI applications. Yesterday I released v3.14.0 plus patch releases for v1 and v2, and the most useful part of it is a class of bugs that applies to any setup where routing and authorization are separate steps.

The router and the access-control matcher each derived "the path" from the request on their own, and they did not always agree. When they disagree, a request is authorized as one path and served as another.

The four cases I fixed:

Leading or trailing whitespace. /public%20 decodes to "/public ". The router kept the space and matched a protected catch-all route, while the matcher trimmed it and matched an exact public rule for /public. An anonymous request reached the protected handler. (GHSA-pq93-fjp6-fxgm)

Non-canonical spellings.…