Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 12:15 UTC
chore: Fix golangci-lint 2.12.1 findings (#7690)
Zen Dodd committed
May 7, 2026 at 17:40 UTC
d2172bea61414635c55554b42714af94a3c9cefd
7 files changed
+31
-16
cmd/packagesfuncs.go
+1
-1
@@ -234,7 +234,7 @@ func getModules() (standard, nonstandard, unknown []moduleInfo, err error) {
234
// not sure why), and since New() should return a pointer
235
// value, we need to dereference it first
236
iface := any(modInfo.New())
237
- if rv := reflect.ValueOf(iface); rv.Kind() == reflect.Ptr {
237
+ if rv := reflect.ValueOf(iface); rv.Kind() == reflect.Pointer {
238
iface = reflect.New(reflect.TypeOf(iface).Elem()).Elem().Interface()
239
}
240
modPkgPath := reflect.TypeOf(iface).PkgPath()
context.go
+1
-1
@@ -378,7 +378,7 @@ func (ctx Context) LoadModuleByID(id string, rawMsg json.RawMessage) (any, error
378
// value must be a pointer for unmarshaling into concrete type, even if
379
// the module's concrete type is a slice or map; New() *should* return
380
// a pointer, otherwise unmarshaling errors or panics will occur
381
- if rv := reflect.ValueOf(val); rv.Kind() != reflect.Ptr {
381
+ if rv := reflect.ValueOf(val); rv.Kind() != reflect.Pointer {
382
log.Printf("[WARNING] ModuleInfo.New() for module '%s' did not return a pointer,"+
383
" so we are using reflection to make a pointer instead; please fix this by"+
384
" using new(Type) or &Type notation in your module's New() function.", id)
modules/caddyhttp/fileserver/browse.go
+14
-2
@@ -281,7 +281,13 @@ func (fsrv *FileServer) browseApplyQueryParams(w http.ResponseWriter, r *http.Re
281
sortParam = sortCookie.Value
282
}
283
case sortByName, sortByNameDirFirst, sortBySize, sortByTime:
284
- http.SetCookie(w, &http.Cookie{Name: "sort", Value: sortParam, Secure: r.TLS != nil})
284
+ http.SetCookie(w, &http.Cookie{ //nolint:gosec // Secure depends on whether the request itself used TLS
285
+ Name: "sort",
286
+ Value: sortParam,
287
+ Secure: r.TLS != nil,
288
+ HttpOnly: true,
289
+ SameSite: http.SameSiteLaxMode,
290
+ })
291
}
292
293
// then figure out the order
@@ -292,7 +298,13 @@ func (fsrv *FileServer) browseApplyQueryParams(w http.ResponseWriter, r *http.Re
298
orderParam = orderCookie.Value
299
}
300
case sortOrderAsc, sortOrderDesc:
295
- http.SetCookie(w, &http.Cookie{Name: "order", Value: orderParam, Secure: r.TLS != nil})
301
+ http.SetCookie(w, &http.Cookie{ //nolint:gosec // Secure depends on whether the request itself used TLS
302
+ Name: "order",
303
+ Value: orderParam,
304
+ Secure: r.TLS != nil,
305
+ HttpOnly: true,
306
+ SameSite: http.SameSiteLaxMode,
307
+ })
308
}
309
310
// finally, apply the sorting and limiting
modules/caddyhttp/fileserver/staticfiles.go
+1
-1
@@ -785,7 +785,7 @@ func redirect(w http.ResponseWriter, r *http.Request, toPath string) error {
785
if r.URL.RawQuery != "" {
786
toPath += "?" + r.URL.RawQuery
787
}
788
- http.Redirect(w, r, toPath, http.StatusPermanentRedirect)
788
+ http.Redirect(w, r, toPath, http.StatusPermanentRedirect) //nolint:gosec // toPath is a same-origin path and leading // is stripped above
789
return nil
790
}
791
modules/caddyhttp/reverseproxy/selectionpolicies.go
+6
-4
@@ -664,10 +664,12 @@ func (s CookieHashSelection) Select(pool UpstreamPool, req *http.Request, w http
664
return upstream
665
}
666
cookie := &http.Cookie{
667
- Name: s.Name,
668
- Value: sha,
669
- Path: "/",
670
- Secure: false,
667
+ Name: s.Name,
668
+ Value: sha,
669
+ Path: "/",
670
+ Secure: false,
671
+ HttpOnly: true,
672
+ SameSite: http.SameSiteLaxMode,
673
}
674
isProxyHttps := false
675
if trusted, ok := caddyhttp.GetVar(req.Context(), caddyhttp.TrustedProxyVarKey).(bool); ok && trusted {
modules/caddyhttp/routes.go
+5
-4
@@ -18,6 +18,7 @@ import (
18
"encoding/json"
19
"fmt"
20
"net/http"
21
+ "slices"
22
"strings"
23
24
"github.com/caddyserver/caddy/v2"
@@ -241,8 +242,8 @@ func (routes RouteList) Compile(next Handler) Handler {
242
mid = append(mid, wrapRoute(route))
243
}
244
stack := next
244
- for i := len(mid) - 1; i >= 0; i-- {
245
- stack = mid[i](stack)
245
+ for _, middleware := range slices.Backward(mid) {
246
+ stack = middleware(stack)
247
}
248
return stack
249
}
@@ -305,8 +306,8 @@ func wrapRoute(route Route) Middleware {
306
}
307
308
// compile this route's handler stack
308
- for i := len(route.middleware) - 1; i >= 0; i-- {
309
- nextCopy = route.middleware[i](nextCopy)
309
+ for _, middleware := range slices.Backward(route.middleware) {
310
+ nextCopy = middleware(nextCopy)
311
}
312
313
// Apply metrics instrumentation once for the entire route,
modules/caddyhttp/server.go
+3
-3
@@ -1085,11 +1085,11 @@ func strictUntrustedClientIp(r *http.Request, headers []string, trusted []netip.
1085
for _, headerName := range headers {
1086
parts := strings.Split(strings.Join(r.Header.Values(headerName), ","), ",")
1087
1088
- for i := len(parts) - 1; i >= 0; i-- {
1088
+ for _, part := range slices.Backward(parts) {
1089
// Some proxies may retain the port number, so split if possible
1090
- host, _, err := net.SplitHostPort(parts[i])
1090
+ host, _, err := net.SplitHostPort(part)
1091
if err != nil {
1092
- host = parts[i]
1092
+ host = part
1093
}
1094
1095
// Remove any zone identifier from the IP address