FiloSottile / FiloSottile/torchwood

litebastion: More liberal than the spec, it accepts uppercase key hashes in URLs

Open
#60 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
29
Forks
17
PR merge metrics
No merged PRs in 30d

Description

Spec says that in `https:////`, the key hash MUST be lower-case hex. While litebastion accepts any mix of upper and lowercase. One could consider this a spec issue, but it makes sense for the implementation to be as strict as the spec says.

Contributor guide

Open the contributing guide

Research direction

Start by locating litebastion's URL parsing and the code that validates the key hash in the documented URL structure. Confirm how mixed-case hexadecimal hashes are currently handled, then verify that uppercase hashes are rejected and lower-case hashes remain accepted.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.