lolly

xfy/lolly

Fork 0

Commit Graph

Author	SHA1	Message	Date
xfy	b5c3c0954f	fix: address repository review issues Some checks failed CI / Test (push) Failing after 23s Details CI / Build (push) Has been skipped Details Security: - Enforce client_max_body_size in HTTP/2 and HTTP/3 adapters before buffering - Use trusted-proxy-aware client IP extraction for access control and rate limiting - Include Host and Vary headers in proxy cache key to prevent cache poisoning - Harden static file path traversal check with filepath.Clean + prefix validation - Honor proxy_ssl config for WebSocket upstream TLS Proxy/handler bugs: - Decrement WebSocket connection count immediately on return (not deferred in retry loop) - Remove ineffective headersPool - Coalesce concurrent background cache refreshes with singleflight Dev/build: - Fix Makefile run and test-config targets - Remove broken wget healthcheck from docker-compose - Add missing integration build tags - Fix go vet warnings in tests CI: - Run golangci-lint and integration tests in Gitea Actions Refs: docs/superpowers/plans/2026-06-17-fix-review-issues.md	2026-06-17 11:17:53 +08:00
xfy	27e00b84a8	fix(proxy,handler,server,stream,ratelimit): fix resource leaks and functional bugs - proxy/proxy.go: decrement connection count on dangerous path rejection (line 724) to prevent connection count leak - handler/sendfile_linux.go: return *os.File from getSocketFile and let linuxSendfile close it, fixing EBADF from deferred close in getSocketFd - proxy/websocket.go: return bufio.Reader from readWebSocketUpgradeResponse and wrap targetConn with bufferedConn to consume pre-buffered frame data, preventing first-frame loss - server/pool.go: use non-blocking send after starting new worker to avoid deadlock when queue is full - stream/stream.go: check stopCh on non-timeout UDP read errors to prevent infinite loop and shutdown deadlock - middleware/ratelimit: replace select-based close guard with sync.Once in StopCleanup to prevent double-close panic	2026-06-11 16:35:10 +08:00
xfy	164589a9cc	test(proxy): 添加代理模块低覆盖率函数测试（覆盖率 71.1% → 预计 >80%）新建 internal/proxy/proxy_low_coverage_test.go，覆盖： proxyDebugLog 测试（原 0%）： - 字符串/整数/布尔/错误/nil 值的调试日志 - 空键值对处理 ServeHTTP 测试（原 47.3%）： - GET/POST/PUT 真实后端转发 - 连接拒绝、超时、故障转移 - X-Accel-Redirect 内部重定向 - 可疑路径拦截 - 缓存存储/命中/stale - 重定向重写、空 URL、查询参数 selectTarget 测试（原 46.7%）： - random 算法选择 - Lua 选择成功/回退 selectByLua 测试（原 39.1%）： - 有效脚本执行、未选择、无 ngx 表 backgroundRefresh 测试（原 41.9%）： - 缓存条目重新验证、请求错误 WebSocket 测试（原 15.4%）： - Hijack 失败、读取响应、升级拒绝 - 拨号目标成功/超时 DNS 解析测试（原 0%）： - Start 幂等性、解析器启动失败 - 刷新成功/错误、TTL 获取 - 默认端口处理 WebSocket 辅助函数测试： - 头部配置、升级响应错误、连接关闭错误	2026-06-04 08:33:29 +08:00

Author

SHA1

Message

Date

xfy

b5c3c0954f

fix: address repository review issues

CI / Test (push) Failing after 23s

Details

CI / Build (push) Has been skipped

Details

Security:
- Enforce client_max_body_size in HTTP/2 and HTTP/3 adapters before buffering
- Use trusted-proxy-aware client IP extraction for access control and rate limiting
- Include Host and Vary headers in proxy cache key to prevent cache poisoning
- Harden static file path traversal check with filepath.Clean + prefix validation
- Honor proxy_ssl config for WebSocket upstream TLS

Proxy/handler bugs:
- Decrement WebSocket connection count immediately on return (not deferred in retry loop)
- Remove ineffective headersPool
- Coalesce concurrent background cache refreshes with singleflight

Dev/build:
- Fix Makefile run and test-config targets
- Remove broken wget healthcheck from docker-compose
- Add missing integration build tags
- Fix go vet warnings in tests

CI:
- Run golangci-lint and integration tests in Gitea Actions

Refs: docs/superpowers/plans/2026-06-17-fix-review-issues.md

2026-06-17 11:17:53 +08:00

xfy

27e00b84a8

fix(proxy,handler,server,stream,ratelimit): fix resource leaks and functional bugs

- proxy/proxy.go: decrement connection count on dangerous path rejection
  (line 724) to prevent connection count leak
- handler/sendfile_linux.go: return *os.File from getSocketFile and let
  linuxSendfile close it, fixing EBADF from deferred close in getSocketFd
- proxy/websocket.go: return bufio.Reader from readWebSocketUpgradeResponse
  and wrap targetConn with bufferedConn to consume pre-buffered frame data,
  preventing first-frame loss
- server/pool.go: use non-blocking send after starting new worker to avoid
  deadlock when queue is full
- stream/stream.go: check stopCh on non-timeout UDP read errors to prevent
  infinite loop and shutdown deadlock
- middleware/ratelimit: replace select-based close guard with sync.Once in
  StopCleanup to prevent double-close panic

2026-06-11 16:35:10 +08:00

xfy

164589a9cc

test(proxy): 添加代理模块低覆盖率函数测试（覆盖率 71.1% → 预计 >80%）

新建 internal/proxy/proxy_low_coverage_test.go，覆盖：

proxyDebugLog 测试（原 0%）：
- 字符串/整数/布尔/错误/nil 值的调试日志
- 空键值对处理

ServeHTTP 测试（原 47.3%）：
- GET/POST/PUT 真实后端转发
- 连接拒绝、超时、故障转移
- X-Accel-Redirect 内部重定向
- 可疑路径拦截
- 缓存存储/命中/stale
- 重定向重写、空 URL、查询参数

selectTarget 测试（原 46.7%）：
- random 算法选择
- Lua 选择成功/回退

selectByLua 测试（原 39.1%）：
- 有效脚本执行、未选择、无 ngx 表

backgroundRefresh 测试（原 41.9%）：
- 缓存条目重新验证、请求错误

WebSocket 测试（原 15.4%）：
- Hijack 失败、读取响应、升级拒绝
- 拨号目标成功/超时

DNS 解析测试（原 0%）：
- Start 幂等性、解析器启动失败
- 刷新成功/错误、TTL 获取
- 默认端口处理

WebSocket 辅助函数测试：
- 头部配置、升级响应错误、连接关闭错误

2026-06-04 08:33:29 +08:00

3 Commits