HTTP router lookupFunc panics with index out of range when given bad URLs

[arussellsaw]

👋 hello!

we often see panics coming from our router when we get hit by people vuln scanning our app. we use lookupFunc to serve our frontend if no backend routes match. I think we're just missing a range check before evaluating. Obviously this isn't your code, but it's in the router in the code generated by goa. I'll raise this issue on the treemux repo too, but figured it was worth reporting here.

for what it's worth, it looks like the router hasn't been actively maintained in the last year, perhaps switching to a maintained router would be worthwhile?

an example URL that panics: GET /images/../cgi/cgi_i_filter.js

Here's the rough shape of our setup:

// LookupFunc is associated with a mux router. It permits querying the router to see if it
// can respond to a request.
type LookupFunc func(w http.ResponseWriter, r *http.Request) (httptreemux.LookupResult, bool)

func SinglePageApp(urlPrefix, dirPath string, includeSourcemaps bool) func(h http.Handler, lookupFunc LookupFunc) http.Handler {
	fs := static.LocalFile(dirPath, true)
	fileserver := http.FileServer(fs)
	if urlPrefix != "" {
		fileserver = http.StripPrefix(urlPrefix, fileserver)
	}

	return func(h http.Handler, lookupFunc LookupFunc) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			// If we have an official route for this request, we should skip our handler. We
			// only run when we can't find a match.
			if _, found := lookupFunc(w, r); found {
				h.ServeHTTP(w, r)
				return
			}

			if !fs.Exists(urlPrefix, r.URL.Path) {
				r.URL.Path = "/"
			}
                         // serving the SPA goes here

thanks! 🙏

[raphael]

Thank you for raising the issue. As you mentioned there isn't much Goa can do to fix this. However note that the generated code only requires an object that implements the Goa Muxer interface (and optionally MiddlewareMuxer). The generated example makes use of the router implemented in the Goa HTTP package which relies on httptreemux but that's just a default - not a requirement. I'd love to know if you can provide an alternative implementation that relies on a maintained router.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.