lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
myxce/.wolf/bugs/bug-1962.md
Rongsong Shen f45b85c9e5
docs(buglog): record Gitea sync for bug-1958..bug-1967 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-10-10 10:51:33 +00:00

2.9 KiB
Raw Blame History

id status status_updated status_note component severity timestamp last_seen occurrences files tags related fix_commits gitea_issue gitea_synced_status gitea_synced_hash
bug-1962 fixed 2026-10-10 apiserver security 2026-10-10T10:16:07Z 2026-10-10T10:16:07Z 1
src/frontend/apiserver/middleware/validatehandler.go
apiserver
security
jwt
387a421c
393 fixed 409f4cc5764b

bug-1962: apiserver JWT excluded-path check drops the last character of every entry, matching unintended paths

Description

Observed: (source reading; follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)) ValidateHandler.isExcludedPath (middleware/validatehandler.go:52-61) trims the last character of every excluded entry, not only a trailing *, and matches by prefix: /ping matches any path starting with /pin, and /swagger/*any never matches.

Expected: Exact entries match exactly; only entries ending in * match by prefix. Impact: Security: paths that merely share a prefix with an excluded entry skip JWT validation. Found by: follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)

Environment

  • OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
  • libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
  • Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
  • Build: asan (xce.build)
  • Code: scheduler-framework @ 19be145d-dirty
  • Deployment: any (found by source reading; confirmed by the RED test of the fix)

Reproduction

  1. Request /pinX (or any route sharing the prefix) without a token: JWT validation is skipped.
  • Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
  • Evidence: the code sites quoted in Description; no logs kept.

Root cause

isExcludedPath (middleware/validatehandler.go) cut the last character of every excluded entry and matched by prefix. Pre-existing.

Fix

The (hardcoded) excluded list moved to jwtExcludedPaths; entries match exactly; an entry ending in a gin catch-all segment (/swagger/*any) matches anything under /swagger/; ping, logon, logout and swagger still excluded.

Verification

  • Test: TestIsExcludedPath, TestValidateHandler_PrefixLookAlikeNeedsToken (middleware/validatehandler_test.go): RED isExcludedPath("/pinX") = true, want false, isExcludedPath("/swagger/index.html") = false, want true, /pinX without a token reached the handler (status 200); GREEN after.
  • Suites: xce-build.sh all asan xce.build --incremental on the merged branch, 2026-10-10: C suites Ok 157 / Fail 0; frontend Go tests ok (the build now also runs apiserver cmd, middleware, models and router)
  • Live: n/a: unit/fixture-level verification; no live deployment was run

References

  • Fix commits: 387a421c (on scheduler-framework)
  • Found as a follow-up of the 2026-10-10 P0 fixes (bug-1936..1957)