mirror of
https://github.com/bitechdev/ResolveSpec.git
synced 2026-02-13 20:06:08 +00:00
Middleware enhancements
This commit is contained in:
Hein
@@ -1,6 +1,14 @@
|
||||
# Middleware Package
|
||||
|
||||
HTTP middleware utilities including rate limiting.
|
||||
HTTP middleware utilities for security and performance.
|
||||
|
||||
## Table of Contents
|
||||
|
||||
1. [Rate Limiting](#rate-limiting)
|
||||
2. [Request Size Limits](#request-size-limits)
|
||||
3. [Input Sanitization](#input-sanitization)
|
||||
|
||||
---
|
||||
|
||||
## Rate Limiting
|
||||
|
||||
@@ -370,3 +378,429 @@ func healthHandler(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Request Size Limits
|
||||
|
||||
Protect against oversized request bodies with configurable size limits.
|
||||
|
||||
### Quick Start
|
||||
|
||||
```go
|
||||
import "github.com/bitechdev/ResolveSpec/pkg/middleware"
|
||||
|
||||
// Default: 10MB limit
|
||||
sizeLimiter := middleware.NewRequestSizeLimiter(0)
|
||||
router.Use(sizeLimiter.Middleware)
|
||||
```
|
||||
|
||||
### Custom Size Limit
|
||||
|
||||
```go
|
||||
// 5MB limit
|
||||
sizeLimiter := middleware.NewRequestSizeLimiter(5 * 1024 * 1024)
|
||||
router.Use(sizeLimiter.Middleware)
|
||||
|
||||
// Or use constants
|
||||
sizeLimiter := middleware.NewRequestSizeLimiter(middleware.Size5MB)
|
||||
```
|
||||
|
||||
### Available Size Constants
|
||||
|
||||
```go
|
||||
middleware.Size1MB // 1 MB
|
||||
middleware.Size5MB // 5 MB
|
||||
middleware.Size10MB // 10 MB (default)
|
||||
middleware.Size50MB // 50 MB
|
||||
middleware.Size100MB // 100 MB
|
||||
```
|
||||
|
||||
### Different Limits Per Route
|
||||
|
||||
```go
|
||||
func main() {
|
||||
router := mux.NewRouter()
|
||||
|
||||
// File upload endpoint: 50MB
|
||||
uploadLimiter := middleware.NewRequestSizeLimiter(middleware.Size50MB)
|
||||
uploadRouter := router.PathPrefix("/upload").Subrouter()
|
||||
uploadRouter.Use(uploadLimiter.Middleware)
|
||||
|
||||
// API endpoints: 1MB
|
||||
apiLimiter := middleware.NewRequestSizeLimiter(middleware.Size1MB)
|
||||
apiRouter := router.PathPrefix("/api").Subrouter()
|
||||
apiRouter.Use(apiLimiter.Middleware)
|
||||
}
|
||||
```
|
||||
|
||||
### Dynamic Size Limits
|
||||
|
||||
```go
|
||||
// Custom size based on request
|
||||
sizeFunc := func(r *http.Request) int64 {
|
||||
// Premium users get 50MB
|
||||
if isPremiumUser(r) {
|
||||
return middleware.Size50MB
|
||||
}
|
||||
// Free users get 5MB
|
||||
return middleware.Size5MB
|
||||
}
|
||||
|
||||
router.Use(sizeLimiter.MiddlewareWithCustomSize(sizeFunc))
|
||||
```
|
||||
|
||||
**By Content-Type:**
|
||||
|
||||
```go
|
||||
sizeFunc := func(r *http.Request) int64 {
|
||||
contentType := r.Header.Get("Content-Type")
|
||||
|
||||
switch {
|
||||
case strings.Contains(contentType, "multipart/form-data"):
|
||||
return middleware.Size50MB // File uploads
|
||||
case strings.Contains(contentType, "application/json"):
|
||||
return middleware.Size1MB // JSON APIs
|
||||
default:
|
||||
return middleware.Size10MB // Default
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Error Response
|
||||
|
||||
When size limit exceeded:
|
||||
|
||||
```http
|
||||
HTTP/1.1 413 Request Entity Too Large
|
||||
X-Max-Request-Size: 10485760
|
||||
|
||||
http: request body too large
|
||||
```
|
||||
|
||||
### Complete Example
|
||||
|
||||
```go
|
||||
package main
|
||||
|
||||
import (
|
||||
"log"
|
||||
"net/http"
|
||||
|
||||
"github.com/bitechdev/ResolveSpec/pkg/middleware"
|
||||
"github.com/gorilla/mux"
|
||||
)
|
||||
|
||||
func main() {
|
||||
router := mux.NewRouter()
|
||||
|
||||
// API routes: 1MB limit
|
||||
api := router.PathPrefix("/api").Subrouter()
|
||||
apiLimiter := middleware.NewRequestSizeLimiter(middleware.Size1MB)
|
||||
api.Use(apiLimiter.Middleware)
|
||||
api.HandleFunc("/users", createUserHandler).Methods("POST")
|
||||
|
||||
// Upload routes: 50MB limit
|
||||
upload := router.PathPrefix("/upload").Subrouter()
|
||||
uploadLimiter := middleware.NewRequestSizeLimiter(middleware.Size50MB)
|
||||
upload.Use(uploadLimiter.Middleware)
|
||||
upload.HandleFunc("/file", uploadFileHandler).Methods("POST")
|
||||
|
||||
log.Fatal(http.ListenAndServe(":8080", router))
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Input Sanitization
|
||||
|
||||
Protect against XSS, injection attacks, and malicious input.
|
||||
|
||||
### Quick Start
|
||||
|
||||
```go
|
||||
import "github.com/bitechdev/ResolveSpec/pkg/middleware"
|
||||
|
||||
// Default sanitizer (safe defaults)
|
||||
sanitizer := middleware.DefaultSanitizer()
|
||||
router.Use(sanitizer.Middleware)
|
||||
```
|
||||
|
||||
### Sanitizer Types
|
||||
|
||||
**Default Sanitizer (Recommended):**
|
||||
|
||||
```go
|
||||
sanitizer := middleware.DefaultSanitizer()
|
||||
// ✓ Escapes HTML entities
|
||||
// ✓ Removes null bytes
|
||||
// ✓ Removes control characters
|
||||
// ✓ Blocks XSS patterns (script tags, event handlers)
|
||||
// ✗ Does not strip HTML (allows legitimate content)
|
||||
```
|
||||
|
||||
**Strict Sanitizer:**
|
||||
|
||||
```go
|
||||
sanitizer := middleware.StrictSanitizer()
|
||||
// ✓ All default features
|
||||
// ✓ Strips ALL HTML tags
|
||||
// ✓ Max string length: 10,000 chars
|
||||
```
|
||||
|
||||
### Custom Configuration
|
||||
|
||||
```go
|
||||
sanitizer := &middleware.Sanitizer{
|
||||
StripHTML: true, // Remove HTML tags
|
||||
EscapeHTML: false, // Don't escape (already stripped)
|
||||
RemoveNullBytes: true, // Remove \x00
|
||||
RemoveControlChars: true, // Remove dangerous control chars
|
||||
MaxStringLength: 5000, // Limit to 5000 chars
|
||||
|
||||
// Block patterns (regex)
|
||||
BlockPatterns: []*regexp.Regexp{
|
||||
regexp.MustCompile(`(?i)<script`),
|
||||
regexp.MustCompile(`(?i)javascript:`),
|
||||
},
|
||||
|
||||
// Custom sanitization function
|
||||
CustomSanitizer: func(s string) string {
|
||||
// Your custom logic
|
||||
return strings.ToLower(s)
|
||||
},
|
||||
}
|
||||
|
||||
router.Use(sanitizer.Middleware)
|
||||
```
|
||||
|
||||
### What Gets Sanitized
|
||||
|
||||
**Automatic (via middleware):**
|
||||
- Query parameters
|
||||
- Headers (User-Agent, Referer, X-Forwarded-For, X-Real-IP)
|
||||
|
||||
**Manual (in your handler):**
|
||||
- Request body (JSON, form data)
|
||||
- Database queries
|
||||
- File names
|
||||
|
||||
### Manual Sanitization
|
||||
|
||||
**String Values:**
|
||||
|
||||
```go
|
||||
sanitizer := middleware.DefaultSanitizer()
|
||||
|
||||
// Sanitize user input
|
||||
username := sanitizer.Sanitize(r.FormValue("username"))
|
||||
email := sanitizer.Sanitize(r.FormValue("email"))
|
||||
```
|
||||
|
||||
**Map/JSON Data:**
|
||||
|
||||
```go
|
||||
var data map[string]interface{}
|
||||
json.Unmarshal(body, &data)
|
||||
|
||||
// Sanitize all string values recursively
|
||||
sanitizedData := sanitizer.SanitizeMap(data)
|
||||
```
|
||||
|
||||
**Nested Structures:**
|
||||
|
||||
```go
|
||||
type User struct {
|
||||
Name string
|
||||
Email string
|
||||
Bio string
|
||||
Profile map[string]interface{}
|
||||
}
|
||||
|
||||
// After unmarshaling
|
||||
user.Name = sanitizer.Sanitize(user.Name)
|
||||
user.Email = sanitizer.Sanitize(user.Email)
|
||||
user.Bio = sanitizer.Sanitize(user.Bio)
|
||||
user.Profile = sanitizer.SanitizeMap(user.Profile)
|
||||
```
|
||||
|
||||
### Specialized Sanitizers
|
||||
|
||||
**Filenames:**
|
||||
|
||||
```go
|
||||
import "github.com/bitechdev/ResolveSpec/pkg/middleware"
|
||||
|
||||
filename := middleware.SanitizeFilename(uploadedFilename)
|
||||
// Removes: .., /, \, null bytes
|
||||
// Limits: 255 characters
|
||||
```
|
||||
|
||||
**Emails:**
|
||||
|
||||
```go
|
||||
email := middleware.SanitizeEmail(" USER@EXAMPLE.COM ")
|
||||
// Result: "user@example.com"
|
||||
// Trims, lowercases, removes null bytes
|
||||
```
|
||||
|
||||
**URLs:**
|
||||
|
||||
```go
|
||||
url := middleware.SanitizeURL(userInput)
|
||||
// Blocks: javascript:, data: protocols
|
||||
// Removes: null bytes
|
||||
```
|
||||
|
||||
### Blocked Patterns (Default)
|
||||
|
||||
The default sanitizer blocks:
|
||||
|
||||
1. **Script tags**: `<script>...</script>`
|
||||
2. **JavaScript protocol**: `javascript:alert(1)`
|
||||
3. **Event handlers**: `onclick="..."`, `onerror="..."`
|
||||
4. **Iframes**: `<iframe src="...">`
|
||||
5. **Objects**: `<object data="...">`
|
||||
6. **Embeds**: `<embed src="...">`
|
||||
|
||||
### Security Best Practices
|
||||
|
||||
**1. Layer Defense:**
|
||||
|
||||
```go
|
||||
// Layer 1: Middleware (query params, headers)
|
||||
router.Use(sanitizer.Middleware)
|
||||
|
||||
// Layer 2: Input validation (in handler)
|
||||
func createUserHandler(w http.ResponseWriter, r *http.Request) {
|
||||
var user User
|
||||
json.NewDecoder(r.Body).Decode(&user)
|
||||
|
||||
// Sanitize
|
||||
user.Name = sanitizer.Sanitize(user.Name)
|
||||
user.Email = middleware.SanitizeEmail(user.Email)
|
||||
|
||||
// Validate
|
||||
if !isValidEmail(user.Email) {
|
||||
http.Error(w, "Invalid email", 400)
|
||||
return
|
||||
}
|
||||
|
||||
// Use parameterized queries (prevents SQL injection)
|
||||
db.Exec("INSERT INTO users (name, email) VALUES (?, ?)",
|
||||
user.Name, user.Email)
|
||||
}
|
||||
```
|
||||
|
||||
**2. Context-Aware Sanitization:**
|
||||
|
||||
```go
|
||||
// HTML content (user posts, comments)
|
||||
sanitizer := middleware.StrictSanitizer()
|
||||
post.Content = sanitizer.Sanitize(post.Content)
|
||||
|
||||
// Structured data (JSON API)
|
||||
sanitizer := middleware.DefaultSanitizer()
|
||||
data = sanitizer.SanitizeMap(jsonData)
|
||||
|
||||
// Search queries (preserve special chars)
|
||||
query = middleware.SanitizeFilename(searchTerm) // Light sanitization
|
||||
```
|
||||
|
||||
**3. Output Encoding:**
|
||||
|
||||
```go
|
||||
// When rendering HTML
|
||||
import "html/template"
|
||||
|
||||
tmpl := template.Must(template.New("page").Parse(`
|
||||
<h1>{{.Title}}</h1>
|
||||
<p>{{.Content}}</p>
|
||||
`))
|
||||
|
||||
// template.HTML automatically escapes
|
||||
tmpl.Execute(w, data)
|
||||
```
|
||||
|
||||
### Complete Example
|
||||
|
||||
```go
|
||||
package main
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"log"
|
||||
"net/http"
|
||||
|
||||
"github.com/bitechdev/ResolveSpec/pkg/middleware"
|
||||
"github.com/gorilla/mux"
|
||||
)
|
||||
|
||||
func main() {
|
||||
router := mux.NewRouter()
|
||||
|
||||
// Apply sanitization middleware
|
||||
sanitizer := middleware.DefaultSanitizer()
|
||||
router.Use(sanitizer.Middleware)
|
||||
|
||||
router.HandleFunc("/api/users", createUserHandler).Methods("POST")
|
||||
|
||||
log.Fatal(http.ListenAndServe(":8080", router))
|
||||
}
|
||||
|
||||
func createUserHandler(w http.ResponseWriter, r *http.Request) {
|
||||
sanitizer := middleware.DefaultSanitizer()
|
||||
|
||||
var user struct {
|
||||
Name string `json:"name"`
|
||||
Email string `json:"email"`
|
||||
Bio string `json:"bio"`
|
||||
}
|
||||
|
||||
if err := json.NewDecoder(r.Body).Decode(&user); err != nil {
|
||||
http.Error(w, "Invalid JSON", 400)
|
||||
return
|
||||
}
|
||||
|
||||
// Sanitize inputs
|
||||
user.Name = sanitizer.Sanitize(user.Name)
|
||||
user.Email = middleware.SanitizeEmail(user.Email)
|
||||
user.Bio = sanitizer.Sanitize(user.Bio)
|
||||
|
||||
// Validate
|
||||
if len(user.Name) == 0 || len(user.Email) == 0 {
|
||||
http.Error(w, "Name and email required", 400)
|
||||
return
|
||||
}
|
||||
|
||||
// Save to database (use parameterized queries!)
|
||||
// db.Exec("INSERT INTO users (name, email, bio) VALUES (?, ?, ?)",
|
||||
// user.Name, user.Email, user.Bio)
|
||||
|
||||
w.WriteHeader(http.StatusCreated)
|
||||
json.NewEncoder(w).Encode(map[string]string{
|
||||
"status": "created",
|
||||
})
|
||||
}
|
||||
```
|
||||
|
||||
### Testing Sanitization
|
||||
|
||||
```bash
|
||||
# Test XSS prevention
|
||||
curl -X POST http://localhost:8080/api/users \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{
|
||||
"name": "<script>alert(1)</script>John",
|
||||
"email": "test@example.com",
|
||||
"bio": "My bio with <iframe src=\"evil.com\"></iframe>"
|
||||
}'
|
||||
|
||||
# Script tags and iframes should be removed
|
||||
```
|
||||
|
||||
### Performance
|
||||
|
||||
- **Overhead**: <1ms per request for typical payloads
|
||||
- **Regex compilation**: Done once at initialization
|
||||
- **Safe for production**: Minimal performance impact
|
||||
- **Safe for production**: Minimal performance impact
|
||||
|
||||
251
pkg/middleware/sanitize.go
Normal file
251
pkg/middleware/sanitize.go
Normal file
@@ -0,0 +1,251 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"html"
|
||||
"net/http"
|
||||
"regexp"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// Sanitizer provides input sanitization beyond SQL injection protection
|
||||
type Sanitizer struct {
|
||||
// StripHTML removes HTML tags from input
|
||||
StripHTML bool
|
||||
|
||||
// EscapeHTML escapes HTML entities
|
||||
EscapeHTML bool
|
||||
|
||||
// RemoveNullBytes removes null bytes from input
|
||||
RemoveNullBytes bool
|
||||
|
||||
// RemoveControlChars removes control characters (except newline, carriage return, tab)
|
||||
RemoveControlChars bool
|
||||
|
||||
// MaxStringLength limits individual string field length (0 = no limit)
|
||||
MaxStringLength int
|
||||
|
||||
// BlockPatterns are regex patterns to block (e.g., script tags, SQL keywords)
|
||||
BlockPatterns []*regexp.Regexp
|
||||
|
||||
// Custom sanitization function
|
||||
CustomSanitizer func(string) string
|
||||
}
|
||||
|
||||
// DefaultSanitizer returns a sanitizer with secure defaults
|
||||
func DefaultSanitizer() *Sanitizer {
|
||||
return &Sanitizer{
|
||||
StripHTML: false, // Don't strip by default (breaks legitimate HTML content)
|
||||
EscapeHTML: true, // Escape HTML entities to prevent XSS
|
||||
RemoveNullBytes: true, // Remove null bytes (security best practice)
|
||||
RemoveControlChars: true, // Remove dangerous control characters
|
||||
MaxStringLength: 0, // No limit by default
|
||||
|
||||
// Block common XSS and injection patterns
|
||||
BlockPatterns: []*regexp.Regexp{
|
||||
regexp.MustCompile(`(?i)<script[^>]*>.*?</script>`), // Script tags
|
||||
regexp.MustCompile(`(?i)javascript:`), // JavaScript protocol
|
||||
regexp.MustCompile(`(?i)on\w+\s*=`), // Event handlers (onclick, onerror, etc.)
|
||||
regexp.MustCompile(`(?i)<iframe[^>]*>`), // Iframes
|
||||
regexp.MustCompile(`(?i)<object[^>]*>`), // Objects
|
||||
regexp.MustCompile(`(?i)<embed[^>]*>`), // Embeds
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// StrictSanitizer returns a sanitizer with very strict rules
|
||||
func StrictSanitizer() *Sanitizer {
|
||||
s := DefaultSanitizer()
|
||||
s.StripHTML = true
|
||||
s.MaxStringLength = 10000
|
||||
return s
|
||||
}
|
||||
|
||||
// Sanitize sanitizes a string value
|
||||
func (s *Sanitizer) Sanitize(value string) string {
|
||||
if value == "" {
|
||||
return value
|
||||
}
|
||||
|
||||
// Remove null bytes
|
||||
if s.RemoveNullBytes {
|
||||
value = strings.ReplaceAll(value, "\x00", "")
|
||||
}
|
||||
|
||||
// Remove control characters
|
||||
if s.RemoveControlChars {
|
||||
value = removeControlCharacters(value)
|
||||
}
|
||||
|
||||
// Check block patterns
|
||||
for _, pattern := range s.BlockPatterns {
|
||||
if pattern.MatchString(value) {
|
||||
// Replace matched pattern with empty string
|
||||
value = pattern.ReplaceAllString(value, "")
|
||||
}
|
||||
}
|
||||
|
||||
// Strip HTML tags
|
||||
if s.StripHTML {
|
||||
value = stripHTMLTags(value)
|
||||
}
|
||||
|
||||
// Escape HTML entities
|
||||
if s.EscapeHTML && !s.StripHTML {
|
||||
value = html.EscapeString(value)
|
||||
}
|
||||
|
||||
// Apply max length
|
||||
if s.MaxStringLength > 0 && len(value) > s.MaxStringLength {
|
||||
value = value[:s.MaxStringLength]
|
||||
}
|
||||
|
||||
// Apply custom sanitizer
|
||||
if s.CustomSanitizer != nil {
|
||||
value = s.CustomSanitizer(value)
|
||||
}
|
||||
|
||||
return value
|
||||
}
|
||||
|
||||
// SanitizeMap sanitizes all string values in a map
|
||||
func (s *Sanitizer) SanitizeMap(data map[string]interface{}) map[string]interface{} {
|
||||
result := make(map[string]interface{})
|
||||
for key, value := range data {
|
||||
result[key] = s.sanitizeValue(value)
|
||||
}
|
||||
return result
|
||||
}
|
||||
|
||||
// sanitizeValue recursively sanitizes values
|
||||
func (s *Sanitizer) sanitizeValue(value interface{}) interface{} {
|
||||
switch v := value.(type) {
|
||||
case string:
|
||||
return s.Sanitize(v)
|
||||
case map[string]interface{}:
|
||||
return s.SanitizeMap(v)
|
||||
case []interface{}:
|
||||
result := make([]interface{}, len(v))
|
||||
for i, item := range v {
|
||||
result[i] = s.sanitizeValue(item)
|
||||
}
|
||||
return result
|
||||
default:
|
||||
return value
|
||||
}
|
||||
}
|
||||
|
||||
// Middleware returns an HTTP middleware that sanitizes request headers and query params
|
||||
// Note: Body sanitization should be done at the application level after parsing
|
||||
func (s *Sanitizer) Middleware(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
// Sanitize query parameters
|
||||
if r.URL.RawQuery != "" {
|
||||
q := r.URL.Query()
|
||||
sanitized := false
|
||||
for key, values := range q {
|
||||
for i, value := range values {
|
||||
sanitizedValue := s.Sanitize(value)
|
||||
if sanitizedValue != value {
|
||||
values[i] = sanitizedValue
|
||||
sanitized = true
|
||||
}
|
||||
}
|
||||
if sanitized {
|
||||
q[key] = values
|
||||
}
|
||||
}
|
||||
if sanitized {
|
||||
r.URL.RawQuery = q.Encode()
|
||||
}
|
||||
}
|
||||
|
||||
// Sanitize specific headers (User-Agent, Referer, etc.)
|
||||
dangerousHeaders := []string{
|
||||
"User-Agent",
|
||||
"Referer",
|
||||
"X-Forwarded-For",
|
||||
"X-Real-IP",
|
||||
}
|
||||
|
||||
for _, header := range dangerousHeaders {
|
||||
if value := r.Header.Get(header); value != "" {
|
||||
sanitized := s.Sanitize(value)
|
||||
if sanitized != value {
|
||||
r.Header.Set(header, sanitized)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
|
||||
// Helper functions
|
||||
|
||||
// removeControlCharacters removes control characters except \n, \r, \t
|
||||
func removeControlCharacters(s string) string {
|
||||
var result strings.Builder
|
||||
for _, r := range s {
|
||||
// Keep newline, carriage return, tab, and non-control characters
|
||||
if r == '\n' || r == '\r' || r == '\t' || r >= 32 {
|
||||
result.WriteRune(r)
|
||||
}
|
||||
}
|
||||
return result.String()
|
||||
}
|
||||
|
||||
// stripHTMLTags removes HTML tags from a string
|
||||
func stripHTMLTags(s string) string {
|
||||
// Simple regex to remove HTML tags
|
||||
re := regexp.MustCompile(`<[^>]*>`)
|
||||
return re.ReplaceAllString(s, "")
|
||||
}
|
||||
|
||||
// Common sanitization patterns
|
||||
|
||||
// SanitizeFilename sanitizes a filename
|
||||
func SanitizeFilename(filename string) string {
|
||||
// Remove path traversal attempts
|
||||
filename = strings.ReplaceAll(filename, "..", "")
|
||||
filename = strings.ReplaceAll(filename, "/", "")
|
||||
filename = strings.ReplaceAll(filename, "\\", "")
|
||||
|
||||
// Remove null bytes
|
||||
filename = strings.ReplaceAll(filename, "\x00", "")
|
||||
|
||||
// Limit length
|
||||
if len(filename) > 255 {
|
||||
filename = filename[:255]
|
||||
}
|
||||
|
||||
return filename
|
||||
}
|
||||
|
||||
// SanitizeEmail performs basic email sanitization
|
||||
func SanitizeEmail(email string) string {
|
||||
email = strings.TrimSpace(strings.ToLower(email))
|
||||
|
||||
// Remove dangerous characters
|
||||
email = strings.ReplaceAll(email, "\x00", "")
|
||||
email = removeControlCharacters(email)
|
||||
|
||||
return email
|
||||
}
|
||||
|
||||
// SanitizeURL performs basic URL sanitization
|
||||
func SanitizeURL(url string) string {
|
||||
url = strings.TrimSpace(url)
|
||||
|
||||
// Remove null bytes
|
||||
url = strings.ReplaceAll(url, "\x00", "")
|
||||
|
||||
// Block javascript: and data: protocols
|
||||
if strings.HasPrefix(strings.ToLower(url), "javascript:") {
|
||||
return ""
|
||||
}
|
||||
if strings.HasPrefix(strings.ToLower(url), "data:") {
|
||||
return ""
|
||||
}
|
||||
|
||||
return url
|
||||
}
|
||||
70
pkg/middleware/sizelimit.go
Normal file
70
pkg/middleware/sizelimit.go
Normal file
@@ -0,0 +1,70 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
)
|
||||
|
||||
const (
|
||||
// DefaultMaxRequestSize is the default maximum request body size (10MB)
|
||||
DefaultMaxRequestSize = 10 * 1024 * 1024 // 10MB
|
||||
|
||||
// MaxRequestSizeHeader is the header name for max request size
|
||||
MaxRequestSizeHeader = "X-Max-Request-Size"
|
||||
)
|
||||
|
||||
// RequestSizeLimiter limits the size of request bodies
|
||||
type RequestSizeLimiter struct {
|
||||
maxSize int64
|
||||
}
|
||||
|
||||
// NewRequestSizeLimiter creates a new request size limiter
|
||||
// maxSize is in bytes. If 0, uses DefaultMaxRequestSize (10MB)
|
||||
func NewRequestSizeLimiter(maxSize int64) *RequestSizeLimiter {
|
||||
if maxSize <= 0 {
|
||||
maxSize = DefaultMaxRequestSize
|
||||
}
|
||||
return &RequestSizeLimiter{
|
||||
maxSize: maxSize,
|
||||
}
|
||||
}
|
||||
|
||||
// Middleware returns an HTTP middleware that enforces request size limits
|
||||
func (rsl *RequestSizeLimiter) Middleware(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
// Set max bytes reader on the request body
|
||||
r.Body = http.MaxBytesReader(w, r.Body, rsl.maxSize)
|
||||
|
||||
// Add informational header
|
||||
w.Header().Set(MaxRequestSizeHeader, fmt.Sprintf("%d", rsl.maxSize))
|
||||
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
|
||||
// MiddlewareWithCustomSize returns middleware with a custom size limit function
|
||||
// This allows different size limits based on the request
|
||||
func (rsl *RequestSizeLimiter) MiddlewareWithCustomSize(sizeFunc func(*http.Request) int64) func(http.Handler) http.Handler {
|
||||
return func(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
maxSize := sizeFunc(r)
|
||||
if maxSize <= 0 {
|
||||
maxSize = rsl.maxSize
|
||||
}
|
||||
|
||||
r.Body = http.MaxBytesReader(w, r.Body, maxSize)
|
||||
w.Header().Set(MaxRequestSizeHeader, fmt.Sprintf("%d", maxSize))
|
||||
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// Common size limits
|
||||
const (
|
||||
Size1MB = 1 * 1024 * 1024
|
||||
Size5MB = 5 * 1024 * 1024
|
||||
Size10MB = 10 * 1024 * 1024
|
||||
Size50MB = 50 * 1024 * 1024
|
||||
Size100MB = 100 * 1024 * 1024
|
||||
)
|
||||
Reference in New Issue
Block a user