Franz Kafka da367a1bfd security: harden against SAST findings (criticals through mediums) ... Critical: - Validate baseURL/sourceURL/upstreamURL at config load time (prevents XML injection, XSS, SSRF via config/env manipulation) - Use xml.Escape for OpenSearch XML template interpolation High: - Add security headers middleware (CSP, X-Frame-Options, HSTS, etc.) - Sanitize result URLs to reject javascript:/data: schemes - Sanitize infobox img_src against dangerous URL schemes - Default CORS to deny-all (was wildcard *) Medium: - Rate limiter: X-Forwarded-For only trusted from configured proxies - Validate engine names against known registry allowlist - Add 1024-char max query length - Sanitize upstream error messages (strip raw response bodies) - Upstream client validates URL scheme (http/https only) Test updates: - Update extractIP tests for new trusted proxy behavior		2026-03-22 16:22:27 +00:00
..
cors.go	security: harden against SAST findings (criticals through mediums)	2026-03-22 16:22:27 +00:00
cors_test.go	feat: add CORS and rate limiting middleware	2026-03-21 15:54:52 +00:00
ratelimit.go	security: harden against SAST findings (criticals through mediums)	2026-03-22 16:22:27 +00:00
ratelimit_burst_test.go	feat: add global and burst rate limiters	2026-03-21 18:35:31 +00:00
ratelimit_global.go	security: harden against SAST findings (criticals through mediums)	2026-03-22 16:22:27 +00:00
ratelimit_global_test.go	feat: add global and burst rate limiters	2026-03-21 18:35:31 +00:00
ratelimit_test.go	security: harden against SAST findings (criticals through mediums)	2026-03-22 16:22:27 +00:00
security.go	security: harden against SAST findings (criticals through mediums)	2026-03-22 16:22:27 +00:00