fix(deps): update module github.com/gin-gonic/gin to v1.9.1 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github.com/gin-gonic/gin	require	minor	v1.8.2 -> v1.9.1

GitHub Vulnerability Alerts

CVE-2023-26125

Versions of the package github.com/gin-gonic/gin before version 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning.

Note: Although this issue does not pose a significant threat on its own it can serve as an input vector for other more impactful vulnerabilities. However, successful exploitation may depend on the server configuration and whether the header is used in the application logic.

CVE-2023-29401

The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat";x=.txt" will be sent as a file named "setup.bat".

If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.

---

Release Notes

gin-gonic/gin (github.com/gin-gonic/gin)

v1.9.1

Compare Source

BUG FIXES

• fix Request.Context() checks #​3512

SECURITY

• fix lack of escaping of filename in Content-Disposition #​3556

ENHANCEMENTS

• refactor: use bytes.ReplaceAll directly #​3455
• convert strings and slices using the officially recommended way #​3344
• improve render code coverage #​3525

DOCS

• docs: changed documentation link for trusted proxies #​3575
• chore: improve linting, testing, and GitHub Actions setup #​3583

v1.9.0

Compare Source

BREAK CHANGES

• Stop useless panicking in context and render #​2150

BUG FIXES

• fix(router): tree bug where loop index is not decremented. #​3460
• fix(context): panic on NegotiateFormat - index out of range #​3397
• Add escape logic for header #​3500 and #​3503

SECURITY

• Fix the GO-2022-0969 and GO-2022-0288 vulnerabilities #​3333
• fix(security): vulnerability GO-2023-1571 #​3505

ENHANCEMENTS

• feat: add sonic json support #​3184
• chore(file): Creates a directory named path #​3316
• fix: modify interface check way #​3327
• remove deprecated of package io/ioutil #​3395
• refactor: avoid calling strings.ToLower twice #​3343
• console logger HTTP status code bug fixed #​3453
• chore(yaml): upgrade dependency to v3 version #​3456
• chore(router): match method added to routergroup for multiple HTTP methods supporting #​3464
• chore(http): add support for go1.20 http.rwUnwrapper to gin.responseWriter #​3489

DOCS

• docs: update markdown format #​3260
• docs(readme): Add the TOML rendering example #​3400
• docs(readme): move more example to docs/doc.md #​3449
• docs: update markdown format #​3446

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[ti-chi-bot]

[REVIEW NOTIFICATION]

This pull request has not been approved.

To complete the pull request process, please ask the reviewers in the list to review by filling /cc @reviewer in the comment.
After your PR has acquired the required number of LGTMs, you can assign this pull request to the committer in the list by filling /assign @committer in the comment to help you merge this pull request.

The full list of commands accepted by this bot can be found here.

Reviewer can indicate their review by submitting an approval review.
Reviewer can cancel approval by submitting a request changes review.

[ti-chi-bot]

Hi @renovate[bot]. Thanks for your PR.

I'm waiting for a ti-community-infra member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[ti-chi-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Send feedback to sig-community-infra or wuhuizuo.
/lifecycle stale

[wuhuizuo]

/ok-to-test

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠ Warning: custom changes will be lost.

[wuhuizuo]

/lgtm
/approve

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: wuhuizuo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [wuhuizuo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2023-10-24 10:32:11.115124417 +0000 UTC m=+2344328.702234562: ☑️ agreed by wuhuizuo.