sanitize

Documentation

Index

• Variables
• func DefaultKeyValuesSanitizerFunc(_ string, _ ...string) []string
• func DefaultPathSanitizerFunc(p string) string
• func PathUUIDs(path string) string
• func Request(r *http.Request, opts ...RequestOption) *http.Request
• type KeyValuesSanitizer
• type KeyValuesSanitizerFunc
  • func (vsf KeyValuesSanitizerFunc) SanitizeKeyValues(key string, values ...string) []string
• type PathSanitizer
• type PathSanitizerFunc
  • func (psf PathSanitizerFunc) SanitizePath(path string) string
• type RequestOption
  • func OptRequestAddDisallowedHeaders(headers ...string) RequestOption
  • func OptRequestAddDisallowedQueryParams(queryParams ...string) RequestOption
  • func OptRequestKeyValuesSanitizer(valueSanitizer KeyValuesSanitizer) RequestOption
  • func OptRequestPathSanitizer(pathSanitizer PathSanitizer) RequestOption
  • func OptRequestSetDisallowedHeaders(headers ...string) RequestOption
  • func OptRequestSetDisallowedQueryParams(queryParams ...string) RequestOption
• type RequestSanitizer
  • func NewRequestSanitizer(opts ...RequestOption) RequestSanitizer
  • func (rs RequestSanitizer) IsHeaderDisallowed(header string) bool
  • func (rs RequestSanitizer) IsQueryParamDisallowed(queryParam string) bool
  • func (rs RequestSanitizer) Sanitize(r *http.Request) *http.Request

Variables

var (
	DefaultSanitizationDisallowedHeaders     = []string{"authorization", "cookie", "set-cookie"}
	DefaultSanitizationDisallowedQueryParams = []string{"access_token", "client_secret"}
)

Default values for disallowed field names Note: the values are compared using `strings.EqualFold` so the casing shouldn't matter

Functions

func DefaultKeyValuesSanitizerFunc

func DefaultKeyValuesSanitizerFunc(_ string, _ ...string) []string

DefaultKeyValuesSanitizerFunc is the default value sanitizer.

For any given key's values it will simply return nil, implying that the key was one of the banned keys and we should completely omit the values.

func DefaultPathSanitizerFunc

func DefaultPathSanitizerFunc(p string) string

DefaultPathSanitizerFunc is a default implementation of a path sanitizer func that just returns the original path.

func PathUUIDs

func PathUUIDs(path string) string

PathUUIDs is a path sanitizer func that replaces any uuids in a path with "?".

func Request

func Request(r *http.Request, opts ...RequestOption) *http.Request

Request sanitizes a given request.

Types

type KeyValuesSanitizer

type KeyValuesSanitizer interface {
	SanitizeKeyValues(key string, values ...string) []string
}

KeyValuesSanitizer is a type that can sanitize http header or query key values.

Values are passed from `map[string][]string` typically, hence the `key` and `values...` parameters.

The `SanitizeValue` function should return the modified or sanitized value for each of the input values, for a given key.

type KeyValuesSanitizerFunc

type KeyValuesSanitizerFunc func(key string, values ...string) []string

KeyValuesSanitizerFunc is a function implementation of ValueSanitizer.

func (KeyValuesSanitizerFunc) SanitizeKeyValues

func (vsf KeyValuesSanitizerFunc) SanitizeKeyValues(key string, values ...string) []string

SanitizeKeyValues implements `KeyValuesSanitizer`.

type PathSanitizer

type PathSanitizer interface {
	SanitizePath(path string) string
}

PathSanitizer is a type that can sanitize a url path.

type PathSanitizerFunc

type PathSanitizerFunc func(path string) string

PathSanitizerFunc implements PathSanitizer.

func (PathSanitizerFunc) SanitizePath

func (psf PathSanitizerFunc) SanitizePath(path string) string

SanitizePath implements PathSanitizer.

type RequestOption

type RequestOption func(*RequestSanitizer)

RequestOption is a function that mutates sanitization options.

func OptRequestAddDisallowedHeaders

func OptRequestAddDisallowedHeaders(headers ...string) RequestOption

OptRequestAddDisallowedHeaders adds disallowed request headers, augmenting defaults.

func OptRequestAddDisallowedQueryParams

func OptRequestAddDisallowedQueryParams(queryParams ...string) RequestOption

OptRequestAddDisallowedQueryParams adds disallowed request query params, augmenting defaults.

func OptRequestKeyValuesSanitizer

func OptRequestKeyValuesSanitizer(valueSanitizer KeyValuesSanitizer) RequestOption

OptRequestKeyValuesSanitizer sets the request key values sanitizer.

func OptRequestPathSanitizer

func OptRequestPathSanitizer(pathSanitizer PathSanitizer) RequestOption

OptRequestPathSanitizer sets the request path sanitizer.

func OptRequestSetDisallowedHeaders

func OptRequestSetDisallowedHeaders(headers ...string) RequestOption

OptRequestSetDisallowedHeaders sets the disallowed request headers, overwriting defaults.

func OptRequestSetDisallowedQueryParams

func OptRequestSetDisallowedQueryParams(queryParams ...string) RequestOption

OptRequestSetDisallowedQueryParams sets the disallowed request query params, overwriting defaults.

type RequestSanitizer

type RequestSanitizer struct {
	DisallowedHeaders     []string
	DisallowedQueryParams []string
	KeyValuesSanitizer    KeyValuesSanitizer
	PathSanitizer         PathSanitizer
}

RequestSanitizer are options for sanitization of http requests.

func NewRequestSanitizer

func NewRequestSanitizer(opts ...RequestOption) RequestSanitizer

NewRequestSanitizer creates a new request sanitizer.

func (RequestSanitizer) IsHeaderDisallowed

func (rs RequestSanitizer) IsHeaderDisallowed(header string) bool

IsHeaderDisallowed returns if a header is in the disallowed list.

func (RequestSanitizer) IsQueryParamDisallowed

func (rs RequestSanitizer) IsQueryParamDisallowed(queryParam string) bool

IsQueryParamDisallowed returns if a query param is in the disallowed list.

func (RequestSanitizer) Sanitize

func (rs RequestSanitizer) Sanitize(r *http.Request) *http.Request

Sanitize applies sanitization options to a given request.