mirror of
https://github.com/hanzoai/gateway.git
synced 2026-10-30 15:04:44 +00:00
zeekayandHanzo Dev
765aa24834
Vet does not analyse module dependencies, so these sat unreported for as long as the engine lived in github.com/krakend/*. Folding it in put the code under our own `go vet ./...` and both surfaced immediately. Both are real, both fixes are behaviour-preserving, and neither is cosmetic: binder/context.go — Context.error passed a runtime string as the FORMAT argument of the printf-style LState.RaiseError. That string carries Lua script and host error text, so a '%' anywhere in a message is read as a verb: the error gets mangled and %!v(MISSING) is emitted from input an attacker can influence. Now passed as an argument. ratelimit/router/gin — a `return` after a switch whose every arm (including default) already returns. Unreachable; deleted. Also repoints two doc comments that still named upstream import paths, so the package docs describe where the code actually lives. Nothing else in internal/ deviates from upstream: 196 of 197 files remain byte-identical under the mechanical import rewrite, the lone exception being the bloomfilter subpackage rename from the previous commit. Re-run the check before any upstream re-sync so these four edits are carried forward deliberately rather than silently reverted. go vet ./... and go vet -tags legacy ./... -> both clean Co-authored-by: Hanzo Dev <[email protected]>
43 lines
947 B
Go
43 lines
947 B
Go
package binder
|
|
|
|
import "github.com/yuin/gopher-lua"
|
|
|
|
// Context function context
|
|
type Context struct {
|
|
state *lua.LState
|
|
pushed int
|
|
}
|
|
|
|
// Top returns count of function arguments
|
|
func (c *Context) Top() int {
|
|
return c.state.GetTop()
|
|
}
|
|
|
|
// Arg returns function argument by number
|
|
func (c *Context) Arg(num int) *Argument {
|
|
return &Argument{
|
|
state: c.state,
|
|
number: num,
|
|
}
|
|
}
|
|
|
|
// Push pushes function result
|
|
func (c *Context) Push() *Push {
|
|
return &Push{
|
|
context: c,
|
|
}
|
|
}
|
|
|
|
func (c *Context) increase() {
|
|
c.pushed++
|
|
}
|
|
|
|
func (c *Context) error(e string) {
|
|
// RaiseError is printf-style. `e` is a runtime string — it carries Lua
|
|
// script and host error text — so passing it as the FORMAT lets any '%' in
|
|
// a message be read as a verb, mangling the error and emitting
|
|
// %!v(MISSING) noise from attacker-influenceable input. Pass it as an
|
|
// argument instead. (go vet: non-constant format string.)
|
|
c.state.RaiseError("%s", e)
|
|
}
|