The gin-inject from wuhan005

Hi, I'm E99p1ant. 👋

🐭 Focus on Go.
🏠 Blog at github.red.
📩 Reach me by sending me an email.
🤤 Buy me a cup of coffee.
🌃 Check out my personal side project roadmap.
💫 I'm proud of who I am, what I have built, and what I am building.

Some cool gadgets I made:

🚩 Cardinal - CTF AWD platform / ★882 / Go GORM Vue Server-Sent Events CRUD
💓 mebeats - Real-time MiBand heart rate data collection / ★235 / Go Bluetooh Low Energy Flamego Image generation
🔮 Elaina - Docker-based remote code runner / ★46 / Go Vue Docker Rate Limit CodeMirror
🧹 Houki - Customizable MitM proxy / ★34 / Go MitM HTTP(S) Flamego alpine.js SQLite
☁️ Raika - Hybrid cloud serverless function framework / ★6 / Go Flamego Serverless CLI Daemon
📫 NekoBox - Anonymous question box / ★196 / Go GORM Flamego Uptrace CRUD reCaptcha
😵 ingress-custom-error-pages - Customized Ingress error pages / ★6 / Go Flamego Kubernetes Nginx Ingress
🪤 k8s-image-replacer - Replace image when creating pod, aims to speed up image pulling / ★6 / Go Flamego Kubernetes Mutating Webhook
🚜 forklift - Lightweight container image pre-download component for Kubernetes / ★6 / Go Kubernetes Helm Chart
👻 icppp - The way to bypass website ICP checking / ★68 / Go docker-compose
👾 Apicon - API sharing platform / Go beego GORM Redis Serverless API Gateway Rate Limit
💫 Asteroid - CTF AWD real-time 3D data visualization / ★133 / C# Unity3D WebSocket
🔧 jkit - CLI tool for JSON / ★5 / Go JSON
🔗 Frlink - Beautify WordPress friends links / ★8 / PHP WordPress
🔍 GrabMe - Hide contents in your WordPress posts / ★4 / PHP WordPress

🎯 My CVE list:

CVE-2022-31038 Gogs XSS vulnerability in repository issue list.
CVE-2022-30781 Gitea Remote command exection in repository migration.
CVE-2022-0415 Gogs Remote command execution in file uploading.
CVE-2022-24124 casdoor SQL injection in field filter.
CVE-2022-24123 marktext XSS to RCE in mermaid.js rendered.
CVE-2022-23642 Sourcegraph Remote Code Execution in Sourcegraph gitserver.

panic on concurrent condition

问题

这个项目的依赖容器基于go-macaron/inject，内部实现是map

type injector struct {
	values map[reflect.Type]reflect.Value
	parent Injector
}

依赖注入调用的是injector的Map方法

func (i *injector) Map(val interface{}) TypeMapper {
	i.values[reflect.TypeOf(val)] = reflect.ValueOf(val)
	return i
}

但是，Go的原生map不支持并发写，所以在并发状态下，会报错

if h.flags&hashWriting != 0 { //位置：runtime/map.go line:585 on Go 1.15.4
		throw("concurrent map writes")
}

尝试对写map的部分加锁

sMapLock.Lock() 
		inj.Map(c)
		inj.Map(ginsession.FromContext(c))
		for _, dep := range deps {
			inj.Map(dep)
		}
sMapLock.Unlock()

但是在handler内部报错runtime error: invalid memory address or nil pointer dereference

问题是注入进去的gin.Context为nil，估计还是并发写的锅

修复

因为go-macaron/inject实际只有一个文件，能不能复制出来采用sync.Map实现

Make Gin Great Again!

wuhan005 / gin-inject Goto Github PK

gin-inject's Introduction

Hi, I'm E99p1ant. 👋

gin-inject's People

Watchers

Forkers

gin-inject's Issues

panic on concurrent condition

问题

修复

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent