Skip to content

Commit 60825cd

Browse files
XI QING ZHANGGitHub Enterprise
XI QING ZHANG
authored and
GitHub Enterprise
committed
Merge pull request #37 from ZaaS/SAST
Fix the CrossSiteRequestForgery and Quality.TestCode vulnerabilities found by SAST
2 parents 0286cb8 + 03a8ad6 commit 60825cd

File tree

3 files changed

+46
-29
lines changed

3 files changed

+46
-29
lines changed

‎go.mod‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ module github.ibm.com/ZaaS/spectrum-virtualize-exporter
33
go 1.12
44

55
require (
6+
github.com/gorilla/csrf v1.7.0
7+
github.com/gorilla/mux v1.8.0
68
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
79
github.com/modern-go/reflect2 v1.0.1 // indirect
810
github.com/prometheus/client_golang v1.2.1

‎go.sum‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6r
1111
github.com/cespare/xxhash/v2 v2.1.0 h1:yTUvW7Vhb89inJ+8irsUqiWjh8iT6sQPZiQzI6ReGkA=
1212
github.com/cespare/xxhash/v2 v2.1.0/go.mod h1:dgIUBU3pDso/gPgZ1osOZ0iQf77oPR28Tjxl5dIMyVM=
1313
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
14+
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
1415
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
1516
github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
1617
github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
@@ -22,11 +23,19 @@ github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5y
2223
github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
2324
github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
2425
github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
26+
github.com/google/go-cmp v0.3.0 h1:crn/baboCvb5fXaQ0IJ1SGTsTVrWpDsCWC8EGETZijY=
2527
github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
2628
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
29+
github.com/gorilla/csrf v1.7.0 h1:mMPjV5/3Zd460xCavIkppUdvnl5fPXMpv2uz2Zyg7/Y=
30+
github.com/gorilla/csrf v1.7.0/go.mod h1:+a/4tCmqhG6/w4oafeAZ9pEa3/NZOWYVbD9fV0FwIQA=
31+
github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
32+
github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
33+
github.com/gorilla/securecookie v1.1.1 h1:miw7JPhV+b/lAHSXz4qd/nN9jRiAFV5FwjeKyCS8BvQ=
34+
github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
2735
github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
2836
github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
2937
github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
38+
github.com/konsorten/go-windows-terminal-sequences v1.0.1 h1:mweAR1A6xJ3oS2pRaGiHgQ4OO8tzTaLawm8vnODuwDk=
3039
github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
3140
github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
3241
github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
@@ -38,6 +47,9 @@ github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3Rllmb
3847
github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
3948
github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
4049
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
50+
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
51+
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
52+
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
4153
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
4254
github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
4355
github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
@@ -60,6 +72,7 @@ github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6Mwd
6072
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
6173
github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
6274
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
75+
github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
6376
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
6477
github.com/tidwall/gjson v1.3.5 h1:2oW9FBNu8qt9jy5URgrzsVx/T/KSn3qn/smJQ0crlDQ=
6578
github.com/tidwall/gjson v1.3.5/go.mod h1:P256ACg0Mn+j1RXIDXoss50DeIABTYK1PULOJHhxOls=
@@ -82,9 +95,8 @@ golang.org/x/sys v0.0.0-20191010194322-b09406accb47/go.mod h1:h1NjWce9XRLGQEsW7w
8295
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
8396
gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
8497
gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
98+
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
8599
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
86100
gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
87101
gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
88102
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
89-
gopkg.in/yaml.v2 v2.2.7 h1:VUgggvou5XRW9mHwD/yXxIYSMtY0zoKQf/v226p2nyo=
90-
gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

‎main.go‎

Lines changed: 30 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,9 @@ package main
33
import (
44
"fmt"
55
"net/http"
6-
_ "net/http/pprof"
76

7+
"github.com/gorilla/csrf"
8+
"github.com/gorilla/mux"
89
"github.com/prometheus/client_golang/prometheus"
910
"github.com/prometheus/client_golang/prometheus/promhttp"
1011
"github.com/prometheus/common/log"
@@ -32,7 +33,8 @@ type handler struct {
3233
}
3334

3435
func main() {
35-
36+
r := mux.NewRouter()
37+
CSRF := csrf.Protect([]byte("spectrum-expor-32-bytes-auth-key"))
3638
// Parse flags.
3739
log.AddFlags(kingpin.CommandLine)
3840
kingpin.Version(version.Print("spectrum_virtualize_exporter"))
@@ -53,28 +55,30 @@ func main() {
5355

5456
//Launch http services
5557
// http.HandleFunc(*metricsPath, handlerMetricRequest)
56-
http.Handle(*metricsPath, newHandler(!*disableExporterMetrics))
57-
58-
http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
59-
if r.Method == "GET" {
60-
w.Write([]byte(`<html>
61-
<head><title>Spectrum Virtualize exporter</title></head>
62-
<body>
63-
<h1>Spectrum Virtualize exporter</h1>
64-
<p><a href='` + *metricsPath + `'>Metrics</a></p>
65-
</body>
66-
</html>`))
67-
} else {
68-
http.Error(w, "403 Forbidden", 403)
69-
}
70-
})
58+
r.Handle(*metricsPath, newHandler(!*disableExporterMetrics))
59+
60+
r.HandleFunc("/", rootHandler)
7161
// http.Handle(*metricsPath, prometheus.Handler()) // Normal metrics endpoint for Spectrum Virtualize exporter itself.
7262

7363
log.Infof("Listening for %s on %s\n", *metricsPath, *listenAddress)
74-
log.Fatal(http.ListenAndServe(*listenAddress, nil))
64+
log.Fatal(http.ListenAndServe(*listenAddress, CSRF(r)))
7565

7666
}
7767

68+
func rootHandler(w http.ResponseWriter, r *http.Request) {
69+
if r.Method == "GET" {
70+
w.Write([]byte(`<html>
71+
<head><title>Spectrum Virtualize exporter</title></head>
72+
<body>
73+
<h1>Spectrum Virtualize exporter</h1>
74+
<p><a href='` + *metricsPath + `'>Metrics</a></p>
75+
</body>
76+
</html>`))
77+
} else {
78+
http.Error(w, "403 Forbidden", 403)
79+
}
80+
}
81+
7882
func targetsForRequest(r *http.Request) ([]utils.Targets, error) {
7983
reqTarget := r.URL.Query().Get("target")
8084
if reqTarget == "" {
@@ -112,16 +116,15 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
112116
if err != nil {
113117
http.Error(w, err.Error(), 400)
114118
return
115-
} else {
116-
handler, err := h.innerHandler(targets...)
117-
if err != nil {
118-
log.Warnln("Couldn't create metrics handler:", err)
119-
w.WriteHeader(http.StatusBadRequest)
120-
w.Write([]byte(fmt.Sprintf("Couldn't create metrics handler: %s", err)))
121-
return
122-
}
123-
handler.ServeHTTP(w, r)
124119
}
120+
handler, err := h.innerHandler(targets...)
121+
if err != nil {
122+
log.Warnln("Couldn't create metrics handler:", err)
123+
w.WriteHeader(http.StatusBadRequest)
124+
w.Write([]byte(fmt.Sprintf("Couldn't create metrics handler: %s", err)))
125+
return
126+
}
127+
handler.ServeHTTP(w, r)
125128
} else {
126129
http.Error(w, "403 Forbidden", 403)
127130
}

0 commit comments

Comments
 (0)