sneak
fc115058ef
All checks were successful
check / check (push) Successful in 2m57s
The access log wrote one INFO line per request carrying r.URL.String(). Registered with Use, it runs ahead of the route limiter, so a client flooding the unauthenticated receiver with invented paths wrote attacker-chosen text of attacker-chosen length into the operator's log, one line per request. 3xx and 4xx responses now log the chi route pattern in place of the concrete URL, and the fixed literal "(unmatched)" when routing matched nothing at all. One line per request is retained, so real traffic stays observable and rate accounting still works, but the line's content is now bounded by the service's own route table. 2xx and 5xx keep the full URL. The pattern is only populated after routing, so it is read in the deferred part of the handler rather than before next.ServeHTTP. No other access-log field changes.
12 KiB
12 KiB