Security This release fixes several security issues. Upgrading is recommended. Some fixes change behavior; read "Behavior changes to check before upgrading" below. Request scheme: Context.Scheme() now uses the X-Forwarded-Proto, X-Forwarded-Protocol, X-Forwarded-Ssl and X-Url-Scheme headers only when the request comes directly from a loopback, link-local or private network address or a unix socket…
Security This release fixes several security issues. Upgrading is recommended. Some fixes change behavior; read "Behavior changes to check before upgrading" below. Request scheme: Context.Scheme() now uses the X-Forwarded-Proto, X-Forwarded-Protocol, X-Forwarded-Ssl and X-Url-Scheme headers only when the request comes directly from a loopback, link-local or private network address or a unix socket…
Fixes fix(static): preserve matched handler 404s by @JSap0914 in #3043 fix(group): Implicitly registered group routes should be allowed overwritten in default routes by @aldas in #3049 Enhancements docs: update HTTP badge URLs to HTTPS by @KeloYuan in #2968 docs: correct Any godoc to reflect true arbitrary-method matching by @hyorimitsu in #3046 refactor: use range-over-integer loops by @zxysilent…
Group middleware logic changes PR #2996 reverts back to v4 behavior for a group registering implicit 404 handlers. If you do not want this behavior, you do not want implicit 404 handlers for groups, use: e := echo.NewWithConfig(echo.Config{NoGroupAutoRegister404Routes: true}) g := e.Group("/api") Other noteworthy echancements: Adds first-class support for the QUERY HTTP method RFC 10008 in #3038 e…
Security Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport of the v5 fix (#3016, released in v5.2.1). Thanks to @a-tt-om and @oran-gugu for reporting. Make…
Security Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent. Given following situation: // 0. // given folder structure: // private.txt // public/ // public/index.html // public/text.txt // public/admin/private.txt // 1. share `public/` folder contents from the server root. This…
Security fix(static): reject encoded path separators that bypass route-level middleware by @vishr in #3011 Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport…
Security fix(static): reject encoded path separators that bypass route-level middleware by @vishr in #3009 fix(middleware/static): don't double-unescape request path (#2599) by @vishr in #3006 Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirec…
Security Context.Scheme() should validate values taken from header by @aldas in #2953 Thanks to @shblue21 for reporting this issue - Context.Scheme accepts malformed forwarded scheme values used by host redirects. Enhancements Add golangci linter configuration by @aldas in #2930 Make StartConfig listener creation context-aware by @EricGusmao in #2936 fix(lint): resolve staticcheck issues and impro…
Security Context.Scheme() should validate values taken from header by @aldas in #2962 Thanks to @shblue21 for reporting this issue. Full Changelog: v4.15.1...v4.15.2
Security This change does not break the API contract, but it does introduce breaking changes in logic/behavior. If your application is using c.RealIP() beware and read https://echo.labstack.com/docs/ip-address In v5 the c.RealIP() will now return request.RemoteAddr unless e.IPExtractor has been configured. No potentially spoofable headers are used by default anymore. Configure IPExtractor with pro…
What's Changed CSRF: support older token-based CSRF protection handler that want to render token into template by @aldas in #2905 Full Changelog: v4.15.0...v4.15.1
What's Changed Remove unused import 'errors' from README example by @kumapower17 in #2889 Fix Graceful shutdown: after http.Server.Serve returns we need to wait for graceful shutdown goroutine to finish by @aldas in #2898 Update location of oapi-codegen in README by @mromaszewicz in #2896 Add Go 1.26 to CI flow by @aldas in #2899 Add new function echo.StatusCode by @suwakei in #2892 CSRF: support…
Fix directory traversal vulnerability under Windows in Static middleware when default Echo filesystem is used. Reported by @shblue21 (#2891). This applies to cases when: Windows is used as OS middleware.StaticConfig.Filesystem is nil (default) echo.Filesystem is has not been set explicitly (default) Full Changelog: v5.0.2...v5.0.3