lolly

xfy/lolly

Fork 0

Commit Graph

Author	SHA1	Message	Date
xfy	445401c40f	perf(accesslog): add sample_rate for access log to reduce CPU and allocations Add configurable access log sampling via : - 0.0-1.0 range; defaults to 1.0 (record all) for backward compatibility - Uses lock-free atomic counter for deterministic sampling - Non-2xx responses always logged regardless of sample rate Benchmark results (combined format, /dev/null): Full logging: ~2245 ns/op, 1987 B/op, 17 allocs/op 10% sampling: ~1593 ns/op, 1633 B/op, 6 allocs/op Improvement: -29% latency, -65% allocations/op This addresses the top application-layer CPU hotspot identified in the v0.4.0 profile (LogAccess at 16.36% cumulative CPU).	2026-06-11 13:53:41 +08:00
xfy911	65aaba4e59	docs(config): add package comments for config module - Add package documentation for cache, monitoring, performance, proxy, security, server, ssl, and variable config files - Include author attribution (xfy)	2026-06-03 15:28:53 +08:00
xfy	179090fa34	fix(security): 修复 2 个 CRITICAL + 6 个 HIGH 安全与代码质量问题安全修复: - ConnLimiter Acquire() TOCTOU 竞态: atomic.AddInt64 替代 loadInt64+addInt64 - Cache Purge token 时序侧信道: 改用 subtle.ConstantTimeCompare - Lua Cosocket SSRF: 新增 ip_guard 两层 IP 检查（字面量+解析后），拒绝私有/回环地址 - X-Accel-Redirect 路径遍历: urlpath.Clean + 前缀拒绝（/internal/ /admin/） - CRLF 注入: containsCRLF 校验变量展开后的 header 值，logging.Warn 可观测 - Proxy URI 注入: bytes.ContainsAny 检查 path 中的 @\r\n 危险字符代码质量: - disk_cache.go Set() 7 处静默 return 改为 logging.Error 日志记录 - config.go 从 2392 行拆分为 9 个按域文件（config/server/proxy/security/ssl/cache/performance/monitoring/variable）验证: go build + vet + golangci-lint(0 issues) + test(83.2% 无回归) + race detector 全部通过 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-04-28 10:13:47 +08:00

Author

SHA1

Message

Date

xfy

445401c40f

perf(accesslog): add sample_rate for access log to reduce CPU and allocations

Add configurable access log sampling via :
- 0.0-1.0 range; defaults to 1.0 (record all) for backward compatibility
- Uses lock-free atomic counter for deterministic sampling
- Non-2xx responses always logged regardless of sample rate

Benchmark results (combined format, /dev/null):
  Full logging:    ~2245 ns/op, 1987 B/op, 17 allocs/op
  10% sampling:    ~1593 ns/op, 1633 B/op,  6 allocs/op
  Improvement:     -29% latency, -65% allocations/op

This addresses the top application-layer CPU hotspot identified
in the v0.4.0 profile (LogAccess at 16.36% cumulative CPU).

2026-06-11 13:53:41 +08:00

xfy911

65aaba4e59

docs(config): add package comments for config module

- Add package documentation for cache, monitoring, performance, proxy,
  security, server, ssl, and variable config files
- Include author attribution (xfy)

2026-06-03 15:28:53 +08:00

xfy

179090fa34

fix(security): 修复 2 个 CRITICAL + 6 个 HIGH 安全与代码质量问题

安全修复:
- ConnLimiter Acquire() TOCTOU 竞态: atomic.AddInt64 替代 loadInt64+addInt64
- Cache Purge token 时序侧信道: 改用 subtle.ConstantTimeCompare
- Lua Cosocket SSRF: 新增 ip_guard 两层 IP 检查（字面量+解析后），拒绝私有/回环地址
- X-Accel-Redirect 路径遍历: urlpath.Clean + 前缀拒绝（/internal/ /admin/）
- CRLF 注入: containsCRLF 校验变量展开后的 header 值，logging.Warn 可观测
- Proxy URI 注入: bytes.ContainsAny 检查 path 中的 @\r\n 危险字符

代码质量:
- disk_cache.go Set() 7 处静默 return 改为 logging.Error 日志记录
- config.go 从 2392 行拆分为 9 个按域文件（config/server/proxy/security/ssl/cache/performance/monitoring/variable）

验证: go build + vet + golangci-lint(0 issues) + test(83.2% 无回归) + race detector 全部通过

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-04-28 10:13:47 +08:00

3 Commits