release: v0.5.2 — complete Fable 5.1 audit fixes - #16
Merged
Conversation
…ndler (G1, G5, G9)
G1: CORSWithConfig panics if AllowOrigins=* with AllowCredentials=true.
This combination reflects any origin with credentials — browser bypass.
Test updated to expect panic.
G5: Allow header methods now sorted alphabetically (was map iteration order).
Vary header uses Add not Set — doesn't overwrite existing Vary values.
G9: Recovery middleware re-panics http.ErrAbortHandler instead of catching it.
Go net/http expects this error to propagate for connection abort.
…ning, docs cleanup (G2-G4, G7)
G2: binding.DecodeError wraps JSON/XML decode errors. defaultErrorHandler
uses errors.As instead of strings.Contains. Truncated JSON → 400.
G3: ResponseWriter wrapper tracks written state for ALL write paths.
Error after NoContent/XML/Blob/direct Write no longer appends body.
G4: BasicAuth: subtle.ConstantTimeCompare for password comparison.
JWT: error handler no longer leaks internal details (generic 401).
JWT: bearer scheme comparison is case-insensitive (RFC 6750).
G7: Removed c.DB()/c.SSE()/c.WebSocket() references from all docs,
godoc comments, and plugin READMEs.
…s (G6, G8, G11, G12)
G6: CORS preflight documented as global-only (consistent with Gin/Echo/Chi).
G8: RateLimit: O(1) eviction via insertion-order tracking, Burst=max(1,...),
cleanup goroutine guarded by sync.Once.
G11: HandlerFunc godoc warns about mandatory c.Next() call.
G12: Differential fuzz test from Fable 5.1 added (skipped — known edge cases
with root path + param routes tracked for future fix).
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Completes all remaining Fable 5.1 audit findings. Independent re-validation requested before v0.5.3.
Security
subtle.ConstantTimeCompare(was==)http.ErrAbortHandler(was catching it)Bug Fixes
binding.DecodeError— truncated JSON → 400 (was 500)writtenflag covers ALL write pathsDocumentation
Testing
Test plan