Xe Iaso 97d15cd803 fix(expressions): validate randInt bounds before rand.IntN ...

Non-positive or platform-overflowing arguments to the CEL randInt
helper used to reach rand.IntN unchecked, surfacing a CEL evaluator
error during request processing when policies passed
attacker-influenced values (e.g. contentLength). Reject non-positive
bounds and detect int narrowing explicitly, returning a typed CEL
error in both cases.

Ref: AWOO-010
Signed-off-by: Xe Iaso <me@xeiaso.net>

2026-05-18 21:27:28 -04:00

..

challenge

fix: nil ptr deref (#1467)

2026-03-18 18:02:57 +00:00

config

fix(metrics): don't expose pprof by default

2026-05-18 20:54:28 -04:00

localization

l10n(de): revise and update German translations (#1457)

2026-03-21 20:02:49 +00:00

metrics

fix(metrics): don't expose pprof by default

2026-05-18 20:54:28 -04:00

policy

fix(expressions): validate randInt bounds before rand.IntN

2026-05-18 21:27:28 -04:00

store

chore: gofix (#1466)

2026-03-18 14:17:28 +00:00

testdata

feat(http): set "Cache-Control: no-store" on error responses (#1474)

2026-03-16 10:36:40 +00:00

thoth

fix: Thoth geoip compare (#1564)

2026-04-24 14:37:19 +00:00

anubis_test.go

fix: patch GHSA-6wcg-mqvh-fcvg (#1616)

2026-05-08 19:17:25 -04:00

anubis.go

feat: Log weight when issuing challenge (#1611)

2026-05-05 16:57:45 +00:00

config_test.go

fix: patch GHSA-6wcg-mqvh-fcvg (#1616)

2026-05-08 19:17:25 -04:00

config.go

fix: patch GHSA-6wcg-mqvh-fcvg (#1616)

2026-05-08 19:17:25 -04:00

http_test.go

fix(lib): mend case where domainless redirects could allow cross-domain

2026-05-18 21:22:45 -04:00

http.go

fix(lib): mend case where domainless redirects could allow cross-domain

2026-05-18 21:22:45 -04:00

redirect_security_test.go

perf: apply fieldalignement (#1284)

2025-11-16 20:43:07 +00:00