feat(gateway): add default landing page when RootRedirect is not set #11091
+400
−10
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if w.suppressed404 { | ||
| return len(b), nil // Discard 404 body | ||
| } | ||
| return w.ResponseWriter.Write(b) |
Check warning
Code scanning / CodeQL
Information exposure through a stack trace Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 days ago
To fix the issue, we must ensure that stack trace information (the contents of buf in profile/goroutines.go) is not sent to the user via an HTTP response. When writing such diagnostics, the correct action is to log the stack trace on the server (for administrator/developer analysis) and, for the client, to send a generic error message instead.
Specifically:
- In
profile/goroutines.go, ifWriteAllGoroutineStacksis used as a handler to write goroutine stacks to a user-facing HTTP response, it should instead:- Write a simple message to the response, such as "An unexpected error occurred".
- Log the stack trace server-side using Go's
logpackage (or an equivalent).
- If there are places in
core/corehttp/landing.gowhere stack trace information flows into an HTTP response (specifically via theWritemethod), this must be intercepted and only a generic error or status be sent.
As the data flow is traced from profile/goroutines.go:WriteAllGoroutineStacks, the fix is to log the stack trace and only send a generic message to the writer (ideally, the HTTP response writer).
Required changes:
- In
profile/goroutines.go, updateWriteAllGoroutineStacksso that instead of writingbufto theio.Writer, it logs the stack trace server-side and writes a generic message to the writer. - Add an import for
"log"if not present.
Suggested changeset
1
profile/goroutines.go
Outside changed files
| @@ -3,6 +3,7 @@ | ||
| import ( | ||
| "io" | ||
| "runtime" | ||
| "log" | ||
| ) | ||
|
|
||
| // WriteAllGoroutineStacks writes a stack trace to the given writer. | ||
| @@ -22,6 +23,9 @@ | ||
| // } | ||
| buf = make([]byte, 2*len(buf)) | ||
| } | ||
| _, err := w.Write(buf) | ||
| // Log stack trace on server for diagnostics | ||
| log.Printf("Goroutine stack trace:\n%s", string(buf)) | ||
| // Write a generic message to the writer instead of stack trace | ||
| _, err := w.Write([]byte("An unexpected internal error occurred. Please contact support.")) | ||
| return err | ||
| } |
Copilot is powered by AI and may make mistakes. Always verify output.
display a landing page at gateway root "/" when `Gateway.RootRedirect` is not configured. the page indicates that kubo is working and provides links to documentation and resources. - embed HTML at compile time using go:embed - intercept 404 responses on known gateways (like localhost) with zero-buffering overhead - hide abuse reporting section for localhost/127.0.0.1 - serve landing page on both gateway and RPC API ports
lidel
force-pushed
the
feat/gateway-landing-page
branch
from
10ea4cf to
052e823
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is quality of life improvement where the Gateway port displays a landing page at root "/" when
Gateway.RootRedirectis not configured. the page indicates that kubo is working and provides links to documentation and resources.