From 456afdd7040797ff9a8598ac1524596ec927c760 Mon Sep 17 00:00:00 2001 From: Juan Calderon-Perez <835733+gaby@users.noreply.github.com> Date: Sun, 10 May 2026 22:47:01 -0400 Subject: [PATCH 1/3] =?UTF-8?q?=F0=9F=90=9B=20bug:=20copy=20FullURL=20stri?= =?UTF-8?q?ng=20before=20returning=20pooled=20buffer?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ctx_interface_gen.go | 2 +- req.go | 2 +- req_interface_gen.go | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ctx_interface_gen.go b/ctx_interface_gen.go index bd060f10d9d..413563e839f 100644 --- a/ctx_interface_gen.go +++ b/ctx_interface_gen.go @@ -374,7 +374,7 @@ type Ctx interface { // If Config.TrustProxy false, it returns false. // IsProxyTrusted can check remote ip by proxy ranges and ip map. IsProxyTrusted() bool - // IsFromLocal will return true if request came from local. + // IsFromLocal will return true if request came from a loopback IP. IsFromLocal() bool // IsFromUnixSocket returns true if the request arrived over a Unix domain socket. IsFromUnixSocket() bool diff --git a/req.go b/req.go index f01d38093da..d714b11a6a0 100644 --- a/req.go +++ b/req.go @@ -215,7 +215,7 @@ func (c *DefaultCtx) FullURL() string { buf.WriteString(c.Host()) buf.WriteString(c.OriginalURL()) - return c.app.toString(buf.Bytes()) + return buf.String() } // UserAgent returns the User-Agent request header. diff --git a/req_interface_gen.go b/req_interface_gen.go index 828d0e9a54c..ee6e646a69e 100644 --- a/req_interface_gen.go +++ b/req_interface_gen.go @@ -185,7 +185,7 @@ type Req interface { // If Config.TrustProxy false, it returns false. // IsProxyTrusted can check remote ip by proxy ranges and ip map. IsProxyTrusted() bool - // IsFromLocal will return true if request came from local. + // IsFromLocal will return true if request came from a loopback IP. IsFromLocal() bool // IsFromUnixSocket returns true if the request arrived over a Unix domain socket. IsFromUnixSocket() bool From f9cd6bae01a4ad95bd8a769b40fd419ff227b6cd Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 11 May 2026 02:56:19 +0000 Subject: [PATCH 2/3] test: add FullURL pooled-buffer regression coverage Agent-Logs-Url: https://github.com/gofiber/fiber/sessions/6b1b820e-2612-437e-be11-bb6dc177daa4 Co-authored-by: gaby <835733+gaby@users.noreply.github.com> --- ctx_test.go | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/ctx_test.go b/ctx_test.go index 23c6fd26ae8..30d643beb6a 100644 --- a/ctx_test.go +++ b/ctx_test.go @@ -260,6 +260,29 @@ func Test_Ctx_HeaderHelpers(t *testing.T) { require.False(t, c.HasHeader("X-Trace-Id")) } +// go test -run Test_Ctx_FullURL_DoesNotAliasPooledBuffer +func Test_Ctx_FullURL_DoesNotAliasPooledBuffer(t *testing.T) { + t.Parallel() + + app := New() + c := app.AcquireCtx(&fasthttp.RequestCtx{}) + + c.Request().Header.SetHost("example.com") + c.Request().SetRequestURI("/search?q=fiber") + + fullURL := c.FullURL() + require.Equal(t, "http://example.com/search?q=fiber", fullURL) + + for range 128 { + buf := bytebufferpool.Get() + buf.Reset() + buf.WriteString("https://mutated.example/rewritten") + bytebufferpool.Put(buf) + } + + require.Equal(t, "http://example.com/search?q=fiber", fullURL) +} + // go test -run Test_Ctx_TypedParsingDefaults func Test_Ctx_TypedParsingDefaults(t *testing.T) { t.Parallel() From 5227db4b3e8240cc99105228a0bd8b4d978c41ac Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 11 May 2026 02:59:01 +0000 Subject: [PATCH 3/3] test: clarify FullURL buffer reuse attempts Agent-Logs-Url: https://github.com/gofiber/fiber/sessions/6b1b820e-2612-437e-be11-bb6dc177daa4 Co-authored-by: gaby <835733+gaby@users.noreply.github.com> --- ctx_test.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ctx_test.go b/ctx_test.go index 30d643beb6a..2d465d48609 100644 --- a/ctx_test.go +++ b/ctx_test.go @@ -264,6 +264,8 @@ func Test_Ctx_HeaderHelpers(t *testing.T) { func Test_Ctx_FullURL_DoesNotAliasPooledBuffer(t *testing.T) { t.Parallel() + const bufferPoolReuseAttempts = 128 + app := New() c := app.AcquireCtx(&fasthttp.RequestCtx{}) @@ -273,7 +275,7 @@ func Test_Ctx_FullURL_DoesNotAliasPooledBuffer(t *testing.T) { fullURL := c.FullURL() require.Equal(t, "http://example.com/search?q=fiber", fullURL) - for range 128 { + for range bufferPoolReuseAttempts { buf := bytebufferpool.Get() buf.Reset() buf.WriteString("https://mutated.example/rewritten")