Franz Kafka da367a1bfd security: harden against SAST findings (criticals through mediums) ... Critical: - Validate baseURL/sourceURL/upstreamURL at config load time (prevents XML injection, XSS, SSRF via config/env manipulation) - Use xml.Escape for OpenSearch XML template interpolation High: - Add security headers middleware (CSP, X-Frame-Options, HSTS, etc.) - Sanitize result URLs to reject javascript:/data: schemes - Sanitize infobox img_src against dangerous URL schemes - Default CORS to deny-all (was wildcard *) Medium: - Rate limiter: X-Forwarded-For only trusted from configured proxies - Validate engine names against known registry allowlist - Add 1024-char max query length - Sanitize upstream error messages (strip raw response bodies) - Upstream client validates URL scheme (http/https only) Test updates: - Update extractIP tests for new trusted proxy behavior		2026-03-22 16:22:27 +00:00
..
merge.go	refactor: clean up verbose and redundant comments	2026-03-22 11:10:50 +00:00
merge_test.go	chore: update Go module path to github.com/metamorphosis-dev/kafka	2026-03-21 19:42:01 +00:00
request_params.go	security: harden against SAST findings (criticals through mediums)	2026-03-22 16:22:27 +00:00
request_params_test.go	feat: build Go-based SearXNG-compatible search service	2026-03-20 20:34:08 +01:00
response.go	license: change from MIT to AGPLv3	2026-03-22 08:27:23 +00:00
service.go	license: change from MIT to AGPLv3	2026-03-22 08:27:23 +00:00
service_test.go	chore: update Go module path to github.com/metamorphosis-dev/kafka	2026-03-21 19:42:01 +00:00
types.go	refactor: clean up verbose and redundant comments	2026-03-22 11:10:50 +00:00