Match backend addresses case-insensitively when redacting #24

Merged
benvin merged 1 commits from benvin/redact-backend-case into main 2026-09-08 07:02:01 +10:00
Member

Redaction matched backend addresses exactly, so DNS case variation let an address reach the client.

  • Fold ASCII case when replacing a backend URL, host and hostname
  • Cover the redaction vectors, the same-status agreement rule and the bare-GET premise behind replaying 406/415

Follow-up to #23, merged while this was in review.

Redaction matched backend addresses exactly, so DNS case variation let an address reach the client. - Fold ASCII case when replacing a backend URL, host and hostname - Cover the redaction vectors, the same-status agreement rule and the bare-GET premise behind replaying 406/415 Follow-up to #23, merged while this was in review.
unkin-agent added 1 commit 2026-09-07 23:11:17 +10:00
Match backend addresses case-insensitively when redacting
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
d787d4ff95
DNS names are case-insensitive, so a backend named back in a different
case escaped redaction and reached the client.

- Fold ASCII case when replacing a backend's URL, host and hostname
- Pin the redaction vectors, the same-status rule and the bare-GET
  premise behind treating 406 and 415 as replayable
benvin merged commit 94769a7864 into main 2026-09-08 07:02:01 +10:00
benvin deleted branch benvin/redact-backend-case 2026-09-08 07:02:02 +10:00
Sign in to join this conversation.