Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Include url.Parse error in DsnParseError #52

Merged
merged 1 commit into from
Sep 5, 2019

Conversation

rhcarvalho
Copy link
Contributor

Go 1.11.13 and 1.12.8 received backported fixes for security issues with
url.Parse. One of the fixes includes stricter port validation.

With those minor versions of Go running in Travis,
TestInvalidDsnInvalidPort fails because url.Parse returns an error when
it previously didn't, thus NewDsn returns &DsnParseError{"invalid url"}
instead of &DsnParseError{"invalid port"}.

Including the error from url.Parse in the message both provides more
context for SDK users to understand why their DSN string was refused,
and fixes the test because "invalid port" is part of the now included
error message from url.Parse.

For reference, the backports are:

Go 1.11.13 and 1.12.8 received backported fixes for security issues with
url.Parse. One of the fixes includes stricter port validation.

With those minor versions of Go running in Travis,
TestInvalidDsnInvalidPort fails because url.Parse returns an error when
it previously didn't, thus NewDsn returns &DsnParseError{"invalid url"}
instead of &DsnParseError{"invalid port"}.

Including the error from url.Parse in the message both provides more
context for SDK users to understand why their DSN string was refused,
and fixes the test because "invalid port" is part of the now included
error message from url.Parse.
@rhcarvalho
Copy link
Contributor Author

This fixes the Travis builds for Go 1.11 and 1.12.

For Go 1.10, the problem is that github.com/kataras/iris at current HEAD is incompatible with Go 1.10 (uses strings.ReplaceAll added in Go 1.12). We could make Travis use an older version of iris, but it seems to be time to drop Go 1.10 and add Go 1.13 to Travis, in which case we can specify minimum version requirements with go.mod and the problem will go away.

@kamilogorek kamilogorek merged commit 125f9aa into getsentry:master Sep 5, 2019
@rhcarvalho rhcarvalho deleted the dsn-validation branch September 5, 2019 12:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants