lolly

xfy/lolly

Fork 0

Commit Graph

Author	SHA1	Message	Date
xfy	ceb71cd9cc	feat(config): add Route and RouteType fields to LuaScriptConfig Add route-based matching support for Lua scripts as an alternative to phase-based execution. Scripts can now be matched by path patterns. Fields added: - Route: path/pattern for route matching (mutually exclusive with Phase) - RouteType: matching type (exact, prefix, prefix_priority, regex, regex_caseless) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-09 11:36:13 +08:00
xfy	f3f92c7922	feat(lua): add LState pool configuration and fix coroutine error handling - Add LStatePoolInitialSize and LStatePoolMaxSize config fields - Set pool defaults to 100 initial / 1000 max (matching MaxConcurrentCoroutines) - Fix middleware to return 500 on coroutine init failure instead of continuing - Pass pool config from server init to Lua engine with zero-value fallbacks Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-09 11:13:23 +08:00
xfy	179090fa34	fix(security): 修复 2 个 CRITICAL + 6 个 HIGH 安全与代码质量问题安全修复: - ConnLimiter Acquire() TOCTOU 竞态: atomic.AddInt64 替代 loadInt64+addInt64 - Cache Purge token 时序侧信道: 改用 subtle.ConstantTimeCompare - Lua Cosocket SSRF: 新增 ip_guard 两层 IP 检查（字面量+解析后），拒绝私有/回环地址 - X-Accel-Redirect 路径遍历: urlpath.Clean + 前缀拒绝（/internal/ /admin/） - CRLF 注入: containsCRLF 校验变量展开后的 header 值，logging.Warn 可观测 - Proxy URI 注入: bytes.ContainsAny 检查 path 中的 @\r\n 危险字符代码质量: - disk_cache.go Set() 7 处静默 return 改为 logging.Error 日志记录 - config.go 从 2392 行拆分为 9 个按域文件（config/server/proxy/security/ssl/cache/performance/monitoring/variable）验证: go build + vet + golangci-lint(0 issues) + test(83.2% 无回归) + race detector 全部通过 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-04-28 10:13:47 +08:00

Author

SHA1

Message

Date

xfy

ceb71cd9cc

feat(config): add Route and RouteType fields to LuaScriptConfig

Add route-based matching support for Lua scripts as an alternative to
phase-based execution. Scripts can now be matched by path patterns.

Fields added:
- Route: path/pattern for route matching (mutually exclusive with Phase)
- RouteType: matching type (exact, prefix, prefix_priority, regex, regex_caseless)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-05-09 11:36:13 +08:00

xfy

f3f92c7922

feat(lua): add LState pool configuration and fix coroutine error handling

- Add LStatePoolInitialSize and LStatePoolMaxSize config fields
- Set pool defaults to 100 initial / 1000 max (matching MaxConcurrentCoroutines)
- Fix middleware to return 500 on coroutine init failure instead of continuing
- Pass pool config from server init to Lua engine with zero-value fallbacks

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-05-09 11:13:23 +08:00

xfy

179090fa34

fix(security): 修复 2 个 CRITICAL + 6 个 HIGH 安全与代码质量问题

安全修复:
- ConnLimiter Acquire() TOCTOU 竞态: atomic.AddInt64 替代 loadInt64+addInt64
- Cache Purge token 时序侧信道: 改用 subtle.ConstantTimeCompare
- Lua Cosocket SSRF: 新增 ip_guard 两层 IP 检查（字面量+解析后），拒绝私有/回环地址
- X-Accel-Redirect 路径遍历: urlpath.Clean + 前缀拒绝（/internal/ /admin/）
- CRLF 注入: containsCRLF 校验变量展开后的 header 值，logging.Warn 可观测
- Proxy URI 注入: bytes.ContainsAny 检查 path 中的 @\r\n 危险字符

代码质量:
- disk_cache.go Set() 7 处静默 return 改为 logging.Error 日志记录
- config.go 从 2392 行拆分为 9 个按域文件（config/server/proxy/security/ssl/cache/performance/monitoring/variable）

验证: go build + vet + golangci-lint(0 issues) + test(83.2% 无回归) + race detector 全部通过

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-04-28 10:13:47 +08:00

3 Commits