@cryptotaxi247 / kubo / commits / 20a044e38

fix a race and a potential race in http options

License: MIT Signed-off-by: Steven Allen <steven@stebalien.com>

Steven Allen committed Jan 23, 2018 at 23:36 UTC 20a044e38305fb6000c20be74a438c05a710e159
1 file changed +12 -5
core/corehttp/commands.go
+12 -5
@@ -73,7 +73,13 @@ func addHeadersFromConfig(c *cmdsHttp.ServerConfig, nc *config.Config) {
73 }
74 }
75
76 - c.Headers = nc.API.HTTPHeaders
76 + c.Headers = make(map[string][]string, len(nc.API.HTTPHeaders))
77 +
78 + // Copy these because the config is shared and this function is called
79 + // in multiple places concurrently. Updating these in-place *is* racy.
80 + for h, v := range nc.API.HTTPHeaders {
81 + c.Headers[h] = v
82 + }
83 c.Headers["Server"] = []string{"go-ipfs/" + config.CurrentVersionNumber}
84 }
85
@@ -101,15 +107,16 @@ func patchCORSVars(c *cmdsHttp.ServerConfig, addr net.Addr) {
107 }
108
109 // we're listening on tcp/udp with ports. ("udp!?" you say? yeah... it happens...)
104 - origins := c.AllowedOrigins()
105 - for i, o := range origins {
110 + oldOrigins := c.AllowedOrigins()
111 + newOrigins := make([]string, len(oldOrigins))
112 + for i, o := range oldOrigins {
113 // TODO: allow replacing <host>. tricky, ip4 and ip6 and hostnames...
114 if port != "" {
115 o = strings.Replace(o, "<port>", port, -1)
116 }
110 - origins[i] = o
117 + newOrigins[i] = o
118 }
112 - c.SetAllowedOrigins(origins...)
119 + c.SetAllowedOrigins(newOrigins...)
120 }
121
122 func commandsOption(cctx oldcmds.Context, command *cmds.Command) ServeOption {