mirror of
https://github.com/ipfs/kubo.git
synced 2026-02-21 18:37:45 +08:00
1b490476e5
This commit upgrades go-ipfs-cmds and configures the commands HTTP API Handler to only allow POST/OPTIONS, disallowing GET and others in the handling of command requests in the IPFS HTTP API (where before every type of request method was handled, with GET/POST/PUT/PATCH being equivalent). The Read-Only commands that the HTTP API attaches to the gateway endpoint will additional handled GET as they did before (but stop handling PUT,DELETEs). By limiting the request types we address the possibility that a website accessed by a browser abuses the IPFS API by issuing GET requests to it which have no Origin or Referrer set, and are thus bypass CORS and CSRF protections. This is a breaking change for clients that relay on GET requests against the HTTP endpoint (usually :5001). Applications integrating on top of the gateway-read-only API should still work (including cross-domain access). Co-Authored-By: Steven Allen <steven@stebalien.com> Co-Authored-By: Marcin Rataj <lidel@lidel.org>
31 lines
1.1 KiB
Modula-2
31 lines
1.1 KiB
Modula-2
module github.com/ipfs/go-ipfs/test/dependencies
|
|
|
|
go 1.13
|
|
|
|
require (
|
|
github.com/Kubuxu/gocovmerge v0.0.0-20161216165753-7ecaa51963cd
|
|
github.com/golangci/golangci-lint v1.18.0
|
|
github.com/ipfs/go-blockservice v0.1.2
|
|
github.com/ipfs/go-cid v0.0.5
|
|
github.com/ipfs/go-cidutil v0.0.2
|
|
github.com/ipfs/go-datastore v0.4.4
|
|
github.com/ipfs/go-graphsync v0.0.4
|
|
github.com/ipfs/go-ipfs-blockstore v1.0.0
|
|
github.com/ipfs/go-ipfs-exchange-offline v0.0.1
|
|
github.com/ipfs/go-log v1.0.2
|
|
github.com/ipfs/go-merkledag v0.3.1
|
|
github.com/ipfs/go-unixfs v0.2.4
|
|
github.com/ipfs/hang-fds v0.0.2
|
|
github.com/ipfs/iptb v1.4.0
|
|
github.com/ipfs/iptb-plugins v0.2.2
|
|
github.com/ipld/go-ipld-prime v0.0.2-0.20191108012745-28a82f04c785
|
|
github.com/jbenet/go-random v0.0.0-20190219211222-123a90aedc0c
|
|
github.com/jbenet/go-random-files v0.0.0-20190219210431-31b3f20ebded
|
|
github.com/libp2p/go-libp2p v0.5.2
|
|
github.com/libp2p/go-libp2p-core v0.3.1
|
|
github.com/multiformats/go-multiaddr v0.2.0
|
|
github.com/multiformats/go-multiaddr-net v0.1.2
|
|
github.com/multiformats/go-multihash v0.0.13
|
|
gotest.tools/gotestsum v0.3.5
|
|
)
|