deps:chore - update module github.com/swaggo/http-swagger to v1.2.6 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/swaggo/http-swagger	v1.2.5 -> v1.2.6

GitHub Vulnerability Alerts

CVE-2022-24863

Impact

Allows an attacker to perform a DOS attack consisting of memory exhaustion on the host system.

Patches

Yes. Please upgrade to v1.2.6.

Workarounds

A workaround is to restrict the path prefix to the "GET" method. As shown below

func main() {
	r := mux.NewRouter()

	r.PathPrefix("/swagger/").Handler(httpSwagger.Handler(
		httpSwagger.URL("http://localhost:1323/swagger/doc.json"), //The url pointing to API definition
		httpSwagger.DeepLinking(true),
		httpSwagger.DocExpansion("none"),
		httpSwagger.DomID("#swagger-ui"),
	)).Methods(http.MethodGet)

References

Reporter dongguangli from https://www.huoxian.cn/ company

For more information

If you have any questions or comments about this advisory:

• Open an issue in http-swagger

CVE-2024-25712

http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and *webdav.memFile) can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because (if a solution continued to allow PUT requests) large files could have been blocked without blocking JavaScript, or JavaScript could have been blocked without blocking large files.

---

Release Notes

swaggo/http-swagger (github.com/swaggo/http-swagger)

v1.2.6

Compare Source

Changelog

b7d83e8 fix: security improvement (#​62)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.