mirror of
https://github.com/hanzoai/gateway.git
synced 2026-11-02 08:45:10 +00:00
zeekayandHanzo Dev
765aa24834
Vet does not analyse module dependencies, so these sat unreported for as long as the engine lived in github.com/krakend/*. Folding it in put the code under our own `go vet ./...` and both surfaced immediately. Both are real, both fixes are behaviour-preserving, and neither is cosmetic: binder/context.go — Context.error passed a runtime string as the FORMAT argument of the printf-style LState.RaiseError. That string carries Lua script and host error text, so a '%' anywhere in a message is read as a verb: the error gets mangled and %!v(MISSING) is emitted from input an attacker can influence. Now passed as an argument. ratelimit/router/gin — a `return` after a switch whose every arm (including default) already returns. Unreachable; deleted. Also repoints two doc comments that still named upstream import paths, so the package docs describe where the code actually lives. Nothing else in internal/ deviates from upstream: 196 of 197 files remain byte-identical under the mechanical import rewrite, the lone exception being the bloomfilter subpackage rename from the previous commit. Re-run the check before any upstream re-sync so these four edits are carried forward deliberately rather than silently reverted. go vet ./... and go vet -tags legacy ./... -> both clean Co-authored-by: Hanzo Dev <[email protected]>