mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-10-25 22:10:25 +00:00
xarmian
7376023ff2
* fix(server): the request-body gate reads tokens with jsontext, so a NUL behind a repeated key or beside 1e999 is refused, and a repeated request member is refused on every body (BUG-2812) The body gate and the store's JSON-column guard decoded into map[string]any and walked the tree. The tree is a lossy model: it keeps one value per repeated key, so a NUL in a shadowed copy passed (and the typed decode could merge it into storage), and a number no float64 holds made the decode fail, so the gate answered "no NUL" for a body the typed decode then accepted. Walking that tree also cost about 2x on any body that merely mentioned an escape. - internal/jsonscan wraps github.com/go-json-experiment/json/jsontext (pinned v0.0.0-20260820222146-c27c302e5fc3, BSD-3, The Go Authors). It is the module's only importer; its doc comment names the exit to stdlib encoding/json/jsontext. A differential test pins its acceptance to encoding/json v1's, which found that jsontext refuses a lone surrogate v1 accepts; that case falls back to v1's unquote. - scanRequestBody reads every body once, recording a NUL and a repeated request member separately and reading to the end, so malformed input still reports nothing. Repeats count in the request's own structure, and not in caller data under JSON-encoded keys (BUG-2896 collapses those). Names are case-folded where the destination is a struct: decodeJSONBytes reflects its destination's TOP-LEVEL type, so a struct folds its members, a slice of structs each element's, and a map (admin settings, admin user limits) none. Below the top level only an exact repeat counts. decodeJSONBytes and both bundle paths refuse either. - textguard's document walk and artifactIsBindableText read tokens too, so every layer refuses the shadowed NUL together: the one textguard.KnownGaps case moves into Corpus. - The store's suspect path stays, redundant but correct, by ruling; its deletion is its own unit. Its instruments now pin what is true: no refused value is a suspect, and the remaining suspects are the doubled-backslash class the destination accepts. - The map-model walk survives only as the differential's oracle. * fix(server): update vendorHash and the Postgres-only suspect instruments for the token scan (BUG-2812) The Postgres-backed legs of the suspect path fired when the shared predicate learned to see a NUL behind a repeated key: that value is now a violation everywhere, and the store's own guard refuses it before the destination cast. The preflight legs now assert that, the unmigrated- table fixture uses a doubled-backslash literal (still a suspect), and PostgreSQL's native refusal stays measured by TestNativePostgresAgreesWithTheCorpus. vendorHash is the value this PR's Nix job recomputed.
149 lines
6.9 KiB
Modula-2
149 lines
6.9 KiB
Modula-2
module github.com/PerpetualSoftware/pad
|
|
|
|
go 1.26.5
|
|
|
|
// BUG-2565: build with go1.26.6, which fixes 8 reachable standard-library
|
|
// advisories (GO-2026-5942 and friends — net.Resolver.LookupCNAME,
|
|
// http.Client.Do) that turned CI's govulncheck gate red on 2026-08-13
|
|
// without any commit causing it. A `toolchain` line, not a raise of the
|
|
// `go` directive above, on purpose: GOTOOLCHAIN=auto (every GitHub
|
|
// Actions job sets it) fetches 1.26.6 and stamps it into the binary,
|
|
// while builders pinned to GOTOOLCHAIN=local ignore this line and keep
|
|
// satisfying the 1.26.5 floor. nixpkgs nixos-26.05 still ships go 1.26.5,
|
|
// so raising the floor would break the Nix build outright; see BUG-2567
|
|
// for the Nix-packaged binary, which stays on 1.26.5 until nixpkgs
|
|
// catches up.
|
|
toolchain go1.26.6
|
|
|
|
require (
|
|
github.com/BurntSushi/toml v1.6.0
|
|
github.com/JohannesKaufmann/html-to-markdown/v2 v2.5.2
|
|
github.com/alicebob/miniredis/v2 v2.39.0
|
|
github.com/disintegration/imaging v1.6.2
|
|
github.com/fatih/color v1.19.0
|
|
github.com/go-chi/chi/v5 v5.3.2
|
|
github.com/go-chi/cors v1.2.2
|
|
github.com/go-json-experiment/json v0.0.0-20260820222146-c27c302e5fc3
|
|
github.com/go-shiori/go-readability v0.0.0-20251205110129-5db1dc9836f0
|
|
github.com/google/uuid v1.6.0
|
|
github.com/gorilla/websocket v1.5.3
|
|
github.com/jackc/pgx/v5 v5.11.0
|
|
github.com/mark3labs/mcp-go v1.1.0
|
|
github.com/ory/fosite v0.49.0
|
|
github.com/pb33f/libopenapi v0.38.7
|
|
github.com/pquerna/otp v1.5.0
|
|
github.com/prometheus/client_golang v1.24.1
|
|
github.com/prometheus/client_model v0.6.3
|
|
github.com/prometheus/common v0.71.0
|
|
github.com/redis/go-redis/v9 v9.22.0
|
|
github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
|
|
github.com/sergi/go-diff v1.4.0
|
|
github.com/spf13/cobra v1.10.2
|
|
github.com/spf13/pflag v1.0.10
|
|
github.com/trustelem/zxcvbn v1.0.1
|
|
go.yaml.in/yaml/v4 v4.0.0-rc.6
|
|
golang.org/x/crypto v0.57.0
|
|
golang.org/x/image v0.46.0
|
|
golang.org/x/sys v0.48.0
|
|
golang.org/x/term v0.46.0
|
|
golang.org/x/text v0.42.0
|
|
golang.org/x/time v0.16.0
|
|
golang.org/x/tools v0.50.0
|
|
modernc.org/sqlite v1.59.0
|
|
)
|
|
|
|
require (
|
|
github.com/JohannesKaufmann/dom v0.3.1 // indirect
|
|
github.com/andybalholm/cascadia v1.3.4 // indirect
|
|
github.com/araddon/dateparse v0.0.0-20210429162001-6b43995a97de // indirect
|
|
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
|
|
github.com/bahlo/generic-list-go v0.2.0 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
|
|
github.com/buger/jsonparser v1.1.2 // indirect
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/cristalhq/jwt/v4 v4.0.2 // indirect
|
|
github.com/dgraph-io/ristretto v1.0.0 // indirect
|
|
github.com/dlclark/regexp2 v1.12.0 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/fsnotify/fsnotify v1.6.0 // indirect
|
|
github.com/go-jose/go-jose/v3 v3.0.5 // indirect
|
|
github.com/go-logr/logr v1.4.4 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-shiori/dom v0.0.0-20230515143342-73569d674e1c // indirect
|
|
github.com/gobuffalo/pop/v6 v6.1.1 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f // indirect
|
|
github.com/golang/mock v1.6.0 // indirect
|
|
github.com/google/jsonschema-go v0.4.2 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
|
|
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
|
github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
|
|
github.com/hashicorp/hcl v1.0.0 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
github.com/magiconair/properties v1.8.7 // indirect
|
|
github.com/mattn/go-colorable v0.1.14 // indirect
|
|
github.com/mattn/go-isatty v0.0.24 // indirect
|
|
github.com/mattn/goveralls v0.0.12 // indirect
|
|
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
|
github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/openzipkin/zipkin-go v0.4.3 // indirect
|
|
github.com/ory/go-acc v0.2.9-0.20230103102148-6b1c9a70dbbe // indirect
|
|
github.com/ory/go-convenience v0.1.0 // indirect
|
|
github.com/ory/x v0.0.665 // indirect
|
|
github.com/pb33f/jsonpath v0.8.2 // indirect
|
|
github.com/pb33f/ordered-map/v2 v2.3.1 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.0.9 // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/prometheus/procfs v0.21.1 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/seatgeek/logrus-gelf-formatter v0.0.0-20210414080842-5b05eb8ff761 // indirect
|
|
github.com/sirupsen/logrus v1.9.3 // indirect
|
|
github.com/spf13/afero v1.9.5 // indirect
|
|
github.com/spf13/cast v1.7.1 // indirect
|
|
github.com/spf13/jwalterweatherman v1.1.0 // indirect
|
|
github.com/spf13/viper v1.16.0 // indirect
|
|
github.com/stretchr/testify v1.12.1 // indirect
|
|
github.com/subosito/gotenv v1.4.2 // indirect
|
|
github.com/test-go/testify v1.1.4 // indirect
|
|
github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
|
|
github.com/yuin/gopher-lua v1.1.1 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.46.1 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
|
|
go.opentelemetry.io/contrib/propagators/b3 v1.21.0 // indirect
|
|
go.opentelemetry.io/contrib/propagators/jaeger v1.21.1 // indirect
|
|
go.opentelemetry.io/contrib/samplers/jaegerremote v0.15.1 // indirect
|
|
go.opentelemetry.io/otel v1.45.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/jaeger v1.17.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/zipkin v1.45.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.45.0 // indirect
|
|
go.opentelemetry.io/otel/sdk v1.45.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.45.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.11.0 // indirect
|
|
go.uber.org/atomic v1.11.0 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.5 // indirect
|
|
golang.org/x/mod v0.41.0 // indirect
|
|
golang.org/x/net v0.59.0 // indirect
|
|
golang.org/x/oauth2 v0.36.0 // indirect
|
|
golang.org/x/sync v0.23.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
|
|
google.golang.org/grpc v1.83.2 // indirect
|
|
google.golang.org/protobuf v1.36.12 // indirect
|
|
gopkg.in/ini.v1 v1.67.0 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
modernc.org/libc v1.75.7 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.12.1 // indirect
|
|
)
|