Skip to content
This repository has been archived by the owner on Oct 22, 2024. It is now read-only.

fix(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] #85

Merged
merged 1 commit into from
Oct 24, 2023

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jun 1, 2023

Mend Renovate

This PR contains the following updates:

Package Type Update Change
github.com/gin-gonic/gin require patch v1.9.0 -> v1.9.1

GitHub Vulnerability Alerts

CVE-2023-29401

The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat";x=.txt" will be sent as a file named "setup.bat".

If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.


Release Notes

gin-gonic/gin (github.com/gin-gonic/gin)

v1.9.1

Compare Source

BUG FIXES
SECURITY
  • fix lack of escaping of filename in Content-Disposition #​3556
ENHANCEMENTS
  • refactor: use bytes.ReplaceAll directly #​3455
  • convert strings and slices using the officially recommended way #​3344
  • improve render code coverage #​3525
DOCS
  • docs: changed documentation link for trusted proxies #​3575
  • chore: improve linting, testing, and GitHub Actions setup #​3583

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Jun 1, 2023
@renovate renovate bot requested a review from JordanSussman as a code owner June 1, 2023 20:33
@renovate renovate bot force-pushed the renovate/go-github.com/gin-gonic/gin-vulnerability branch from 5725f89 to c054529 Compare October 24, 2023 20:09
@codecov-commenter
Copy link

Codecov Report

Merging #85 (c054529) into master (5b13b44) will not change coverage.
The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##           master      #85   +/-   ##
=======================================
  Coverage   69.78%   69.78%           
=======================================
  Files          27       27           
  Lines        1466     1466           
=======================================
  Hits         1023     1023           
  Misses        413      413           
  Partials       30       30           

@renovate renovate bot force-pushed the renovate/go-github.com/gin-gonic/gin-vulnerability branch from c054529 to 9b936db Compare October 24, 2023 20:57
Copy link
Collaborator

@delta592 delta592 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good

@delta592 delta592 merged commit 8db3f75 into master Oct 24, 2023
4 checks passed
@delta592 delta592 deleted the renovate/go-github.com/gin-gonic/gin-vulnerability branch October 24, 2023 20:59
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants