clawbot
a96eba8083
check / check (push) Failing after 1s
Adds CSRF protection to the two cookie-authenticated form posts, POST / (login) and POST /generate, using github.com/gorilla/csrf, the recorded default for this job. The token key is derived from signing_key with its own HKDF salt, so it needs no new config and survives restarts. The token cookie is separate from the session cookie, which also covers login CSRF, where no session exists yet. Both templates carry the hidden token field. What a reader would trip over: outside debug mode the library enforces its https Referer origin check, so the TLS-terminating proxy must preserve the Host and Referer headers from the browser or form posts are rejected. Disclosure: one nolint:gosec on a test constant holding the library field name (G101 false positive). Model: opus-4-8 (implementation, review); fable-5-1 (landing message)
161 lines
7.8 KiB
AMPL
161 lines
7.8 KiB
AMPL
module sneak.berlin/go/pixa
|
|
|
|
go 1.25.4
|
|
|
|
require (
|
|
git.eeqj.de/sneak/smartconfig v1.0.0
|
|
github.com/99designs/basicauth-go v0.0.0-20230316000542-bf6f9cbbf0f8
|
|
github.com/davidbyttow/govips/v2 v2.16.0
|
|
github.com/dustin/go-humanize v1.0.1
|
|
github.com/fxamacker/cbor/v2 v2.9.0
|
|
github.com/getsentry/sentry-go v0.40.0
|
|
github.com/go-chi/chi/v5 v5.2.3
|
|
github.com/go-chi/cors v1.2.2
|
|
github.com/gorilla/csrf v1.7.3
|
|
github.com/gorilla/securecookie v1.1.2
|
|
github.com/prometheus/client_golang v1.23.2
|
|
github.com/slok/go-http-metrics v0.13.0
|
|
github.com/spf13/cobra v1.10.2
|
|
go.uber.org/fx v1.24.0
|
|
golang.org/x/crypto v0.41.0
|
|
modernc.org/sqlite v1.42.2
|
|
)
|
|
|
|
require (
|
|
cloud.google.com/go/auth v0.16.2 // indirect
|
|
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
|
|
cloud.google.com/go/compute/metadata v0.7.0 // indirect
|
|
cloud.google.com/go/iam v1.5.2 // indirect
|
|
cloud.google.com/go/secretmanager v1.15.0 // indirect
|
|
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 // indirect
|
|
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.10.1 // indirect
|
|
github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 // indirect
|
|
github.com/Azure/azure-sdk-for-go/sdk/keyvault/azsecrets v0.12.0 // indirect
|
|
github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.1 // indirect
|
|
github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 // indirect
|
|
github.com/armon/go-metrics v0.4.1 // indirect
|
|
github.com/aws/aws-sdk-go-v2 v1.36.6 // indirect
|
|
github.com/aws/aws-sdk-go-v2/config v1.29.18 // indirect
|
|
github.com/aws/aws-sdk-go-v2/credentials v1.17.71 // indirect
|
|
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.33 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.37 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.37 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.18 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.8 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sso v1.25.6 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sts v1.34.1 // indirect
|
|
github.com/aws/smithy-go v1.22.4 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/coreos/go-semver v0.3.1 // indirect
|
|
github.com/coreos/go-systemd/v22 v22.5.0 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/emicklei/go-restful/v3 v3.12.1 // indirect
|
|
github.com/fatih/color v1.16.0 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/go-jose/go-jose/v4 v4.0.5 // indirect
|
|
github.com/go-logr/logr v1.4.2 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-openapi/jsonpointer v0.21.0 // indirect
|
|
github.com/go-openapi/jsonreference v0.20.2 // indirect
|
|
github.com/go-openapi/swag v0.23.0 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
|
|
github.com/golang/protobuf v1.5.4 // indirect
|
|
github.com/google/gnostic-models v0.6.9 // indirect
|
|
github.com/google/go-cmp v0.7.0 // indirect
|
|
github.com/google/s2a-go v0.1.9 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
|
|
github.com/googleapis/gax-go/v2 v2.14.2 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
|
|
github.com/hashicorp/consul/api v1.32.1 // indirect
|
|
github.com/hashicorp/errwrap v1.1.0 // indirect
|
|
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
|
github.com/hashicorp/go-hclog v1.6.3 // indirect
|
|
github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
|
|
github.com/hashicorp/go-multierror v1.1.1 // indirect
|
|
github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
|
|
github.com/hashicorp/go-rootcerts v1.0.2 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
|
|
github.com/hashicorp/go-sockaddr v1.0.2 // indirect
|
|
github.com/hashicorp/golang-lru v0.5.4 // indirect
|
|
github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
|
|
github.com/hashicorp/serf v0.10.1 // indirect
|
|
github.com/hashicorp/vault/api v1.20.0 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/josharian/intern v1.0.0 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/kylelemons/godebug v1.1.0 // indirect
|
|
github.com/mailru/easyjson v0.7.7 // indirect
|
|
github.com/mattn/go-colorable v0.1.13 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mitchellh/go-homedir v1.1.0 // indirect
|
|
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/ncruces/go-strftime v0.1.9 // indirect
|
|
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/prometheus/client_model v0.6.2 // indirect
|
|
github.com/prometheus/common v0.66.1 // indirect
|
|
github.com/prometheus/procfs v0.16.1 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/ryanuber/go-glob v1.0.0 // indirect
|
|
github.com/spf13/pflag v1.0.10 // indirect
|
|
github.com/tidwall/gjson v1.18.0 // indirect
|
|
github.com/tidwall/match v1.1.1 // indirect
|
|
github.com/tidwall/pretty v1.2.0 // indirect
|
|
github.com/x448/float16 v0.8.4 // indirect
|
|
go.etcd.io/etcd/api/v3 v3.6.2 // indirect
|
|
go.etcd.io/etcd/client/pkg/v3 v3.6.2 // indirect
|
|
go.etcd.io/etcd/client/v3 v3.6.2 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
|
|
go.opentelemetry.io/otel v1.36.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.36.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.36.0 // indirect
|
|
go.uber.org/dig v1.19.0 // indirect
|
|
go.uber.org/multierr v1.11.0 // indirect
|
|
go.uber.org/zap v1.27.0 // indirect
|
|
go.yaml.in/yaml/v2 v2.4.2 // indirect
|
|
golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
|
|
golang.org/x/image v0.34.0 // indirect
|
|
golang.org/x/net v0.43.0 // indirect
|
|
golang.org/x/oauth2 v0.30.0 // indirect
|
|
golang.org/x/sync v0.19.0 // indirect
|
|
golang.org/x/sys v0.36.0 // indirect
|
|
golang.org/x/term v0.34.0 // indirect
|
|
golang.org/x/text v0.32.0 // indirect
|
|
golang.org/x/time v0.12.0 // indirect
|
|
google.golang.org/api v0.237.0 // indirect
|
|
google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
|
|
google.golang.org/grpc v1.73.0 // indirect
|
|
google.golang.org/protobuf v1.36.8 // indirect
|
|
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
|
|
gopkg.in/inf.v0 v0.9.1 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
k8s.io/api v0.33.3 // indirect
|
|
k8s.io/apimachinery v0.33.3 // indirect
|
|
k8s.io/client-go v0.33.3 // indirect
|
|
k8s.io/klog/v2 v2.130.1 // indirect
|
|
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
|
|
k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
|
|
modernc.org/libc v1.66.10 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.11.0 // indirect
|
|
sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
|
|
sigs.k8s.io/randfill v1.0.0 // indirect
|
|
sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
|
|
sigs.k8s.io/yaml v1.4.0 // indirect
|
|
)
|