pathpattern

Documentation

Overview

Package pathpattern is the path-matching grammar the framework's path-scoped policies share.

policy:csrf-protection is specified as using the same segment grammar and exclude precedence as policy:authenticated-path-protection, so the two read one implementation rather than two that can drift.

Index

• func CanonicalPath(r *http.Request) (string, bool)
• func CanonicalPathOf(path, raw string) (string, bool)
• func MatchAny(patterns []Pattern, path string) bool
• func Protected(include, exclude []Pattern, path string) bool
• type Pattern
  • func Compile(values []string) ([]Pattern, error)
  • func (p Pattern) Match(path string) bool

Functions

func CanonicalPath

func CanonicalPath(r *http.Request) (string, bool)

canonicalPath rejects a request whose path cannot be matched unambiguously. Dot segments and encoded separators could otherwise select a different routed target than the one the guard decided about. CanonicalPath returns the request path a policy may match against, and reports false for one that cannot be matched unambiguously.

func CanonicalPathOf

func CanonicalPathOf(path, raw string) (string, bool)

CanonicalPathOf is CanonicalPath over the decoded path and the raw one, for a caller whose request is not a *http.Request.

Both are wanted because the refusals need both: an encoded separator is invisible once decoded, and dot segments are what the decoded form shows. A transport that keeps only one of the two passes it as decoded and the other empty, which loses the encoded-separator refusal and is why this takes the pair rather than guessing.

func MatchAny

func MatchAny(patterns []Pattern, path string) bool

MatchAny reports whether any pattern matches path.

func Protected

func Protected(include, exclude []Pattern, path string) bool

Protected reports whether a path falls inside a policy's scope.

Exclude wins over include, and that precedence is the reason this is one function rather than two calls at each site: reversing it would silently widen a policy an operator wrote to narrow one, and the two orders look identical in a diff.

Types

type Pattern

type Pattern struct {
	// contains filtered or unexported fields
}

pattern is one compiled path-protection pattern.

The grammar is deliberately small: a literal segment matches itself, a "*" segment matches exactly one non-empty segment, and a trailing "**" segment matches the prefix itself and every descendant. Regular expressions, query matching, and mid-segment wildcards are not part of it.

func Compile

func Compile(values []string) ([]Pattern, error)

Compile compiles a pattern list, rejecting the first malformed entry.

func (Pattern) Match

func (p Pattern) Match(path string) bool

Match reports whether path matches. path must already be canonical.

The path is walked segment by segment rather than split into a slice: a policy runs this over every include and exclude pattern on every unsafe request, so the match must not allocate.