zhiqiang feng
ce4c2b088f
Bug fixes: - Fix nil-pointer panic in sendMessage SOAP fault handler (used err.Error() on nil) - Fix missing return after SOAP fault response (caused fall-through to 200 OK) - Fix timeout=0 shadowing: removed package-level constant, use configured value - Fix receiveMessage not checking SOAP faults from CIIMS Codec hardening: - Replace fragile regex parsing with encoding/xml.Decoder for namespace-agnostic XML - XML-escape all user inputs (user, pass, event) — not just message body - Remove magic-number-based string slicing (split, GetErrMsg) Transport improvements: - Extract Client type with connection pooling (reuse http.Client across requests) - Add CIIMSResponse domain type with IsFault(), ErrorMessage(), Messages() - Add HTTPStatusError and ResponseTooLargeError typed errors - Replace deprecated ioutil.ReadAll with io.ReadAll - Add response body size limit (64 MiB) Security hardening: - Add MaxBytesReader (1MB request body limit) on both endpoints - Add URL allowlist via CIIMS_ALLOWED_SERVERS env var - Add normalizeBaseURL with scheme/host/query validation - Add count bounds validation (1-1000) on /receive - Add server-level timeouts (ReadHeaderTimeout, ReadTimeout, IdleTimeout) Configuration: - Introduce Config struct to replace package-level globals - Add loadConfig() with full validation and error propagation - Add getIntEnv() with positive-value enforcement Test coverage (75 tests, 35 new): - Phase 1: 8 internal tests (nil receiver, error types, SOAP+HTTP500, malformed XML) - Phase 2: 19 pure function tests (normalizeBaseURL, parseAllowedServers, getIntEnv) - Phase 3: 16 handler tests (send/receive success, SOAP fault, network error, HTTP 500, body too large, invalid JSON, missing fields, URL allowlist) - Phase 4: 8 config/router tests (loadConfig, newServer, newRouter) Toolchain: - Upgrade Go 1.13 → 1.22, gin 1.6.3 → 1.10.0, testify 1.5.1 → 1.10.0 Cleanup: - Remove dead code (unused post() function, commented-out defaults) - Replace println with structured logging - Add .gitignore - Rewrite README with API docs, env vars, security considerations
38 lines
1.4 KiB
AMPL
38 lines
1.4 KiB
AMPL
module gzzn.com/mini/ciimsproxy
|
|
|
|
go 1.22
|
|
|
|
require (
|
|
github.com/gin-gonic/gin v1.9.1
|
|
github.com/stretchr/testify v1.8.4
|
|
)
|
|
|
|
require (
|
|
github.com/bytedance/sonic v1.9.1 // indirect
|
|
github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.2 // indirect
|
|
github.com/gin-contrib/sse v0.1.0 // indirect
|
|
github.com/go-playground/locales v0.14.1 // indirect
|
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
|
github.com/go-playground/validator/v10 v10.14.0 // indirect
|
|
github.com/goccy/go-json v0.10.2 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.2.4 // indirect
|
|
github.com/leodido/go-urn v1.2.4 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.0.8 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
|
|
github.com/ugorji/go/codec v1.2.11 // indirect
|
|
golang.org/x/arch v0.3.0 // indirect
|
|
golang.org/x/crypto v0.9.0 // indirect
|
|
golang.org/x/net v0.10.0 // indirect
|
|
golang.org/x/sys v0.15.0 // indirect
|
|
golang.org/x/text v0.9.0 // indirect
|
|
google.golang.org/protobuf v1.30.0 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|