Ahmet Alp Balkan 19d813d567 Use case-insensitive comparison for Connection upgrade header ...

The isUpgrade() check used exact string match (== "Upgrade") for the
Connection header value. A client sending "Connection: upgrade"
(lowercase) would bypass this check. While not exploitable in practice
(the Upgrade header check catches real upgrades), this hardens the
proxy with defense-in-depth.

Also adds a comprehensive security test suite covering jailbreak
attempts: method override smuggling, path traversal, dryRun parameter
injection, upgrade header smuggling, review endpoint spoofing, unusual
HTTP methods, concurrent request filtering, and credential leakage.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-26 23:06:39 -04:00

..

cmdutil

refactor: replace testutil.WithEnvVar with t.Setenv (#479)

2026-03-08 20:26:40 -07:00

env

Add readonly reverse proxy for kubectx

2026-03-24 23:27:24 -04:00

kubeconfig

Fix relative path resolution in exec credential plugins (#490)

2026-03-23 10:18:48 -07:00

printer

refactor: replace testutil.WithEnvVar with t.Setenv (#479)

2026-03-08 20:26:40 -07:00

proxy

Use case-insensitive comparison for Connection upgrade header

2026-03-26 23:06:39 -04:00

testutil

refactor: replace testutil.WithEnvVar with t.Setenv (#479)

2026-03-08 20:26:40 -07:00