Skip to content

Fix HTTP server timeout exposure and XSS in monitoring exporter #1007

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
or-else merged 2 commits into from
Jul 5, 2026
Merged

Fix HTTP server timeout exposure and XSS in monitoring exporter #1007

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ac7ff2a
Fix security vulnerabilities: HTTP server timeouts, MIME rand, XSS in…
Copilot Jul 5, 2026
fd318fb
Handle crand.Read error in randomBoundary
Copilot Jul 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added exporter
View file
Open in desktop
Binary file not shown.
11 changes: 9 additions & 2 deletions monitoring/exporter/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ package main
import (
"flag"
"fmt"
"html"
"log"
"net/http"
"strings"
Expand Down Expand Up @@ -200,12 +201,18 @@ func main() {

w.Write([]byte(`<html><head><title>Tinode Push</title></head><body>
<h1>Tinode Push</h1>
<pre>` + msg + `</pre>
<pre>` + html.EscapeString(msg) + `</pre>
</body></html>`))
})
}

log.Println("Reading Tinode expvar from", *tinodeAddr)
log.Printf("Exporter running at %s. Server type %s", *listenAt, serverTypeString)
log.Fatalln(http.ListenAndServe(*listenAt, nil))
exporterServer := &http.Server{
Addr: *listenAt,
ReadHeaderTimeout: 10 * time.Second,
IdleTimeout: 30 * time.Second,
WriteTimeout: 90 * time.Second,
}
log.Fatalln(exporterServer.ListenAndServe())
}
10 changes: 9 additions & 1 deletion server/http.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,15 @@ func listenAndServe(addr string, mux *http.ServeMux, tlfConf *tls.Config, stop <

// This is a second HTTP server listenning on a different port.
go func() {
if err := http.ListenAndServe(globals.tlsRedirectHTTP, tlsRedirect(addr)); err != nil && err != http.ErrServerClosed {
redirectServer := &http.Server{
Addr: globals.tlsRedirectHTTP,
Handler: tlsRedirect(addr),
ReadHeaderTimeout: 10 * time.Second,
IdleTimeout: 30 * time.Second,
WriteTimeout: 90 * time.Second,
MaxHeaderBytes: 1 << 14,
}
if err := redirectServer.ListenAndServe(); err != nil && err != http.ErrServerClosed {
logs.Info.Println("HTTP redirect failed:", err)
}
}()
Comment on lines 64 to 76
Expand Down
7 changes: 5 additions & 2 deletions server/validate/email/validate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ import (
"errors"
"fmt"
"math/big"
"math/rand"
"mime"
qp "mime/quotedprintable"
"net/mail"
Expand All @@ -19,6 +18,7 @@ import (
"strconv"
"strings"
textt "text/template"
"time"

"slices"

Expand Down Expand Up @@ -549,7 +549,10 @@ func (a *loginAuth) Next(fromServer []byte, more bool) ([]byte, error) {

func randomBoundary() string {
var buf [24]byte
rand.Read(buf[:])
if _, err := crand.Read(buf[:]); err != nil {
// Fall back to a time-based boundary on the unlikely event crypto/rand fails.
return fmt.Sprintf("tinode--%x", time.Now().UnixNano())
}
return fmt.Sprintf("tinode--%x", buf[:])
}

Expand Down