Chris LuandGitHub 4f43153918 filer: reject a proxyChunkId that isn't a well-formed fid (#10436) ...

LookupFileId only requires the fid to contain a single comma, and the value
is pasted straight into the volume server URL path, so ?proxyChunkId=3,x/../../status
resolves to volume 3 and then addresses an endpoint the caller never named:
Go sends the dot segments verbatim, the volume server's mux cleans the path
and redirects to /status, and the filer follows the redirect and relays the
body. That reaches any handler on the volume server -- status, stats, the UI --
past a filer that operators expect to be the only exposed surface.

Parse the fid before the lookup and answer 400 when it doesn't parse.

A trailing _N delta suffix from batch assigns is legal, so it is stripped
first, but only when it is a non-empty run of digits. The volume server strips
at the last "_" unconditionally, which is safe there because its fid came out
of a path the mux parsed and so cannot hold a "/"; here the value is raw query
input, and an unguarded strip would reduce "3,01637037d6_1/../../status" to a
valid fid and wave the traversal through.

2026-07-25 10:42:33 -07:00

..

constants

Nit: use time.Durations instead of constants in seconds. (#7438)

2025-11-04 13:02:22 -08:00

filer_ui

Fix UI prefix url encoding (#9344)

2026-05-06 19:14:36 -07:00

master_ui

feat: improve aio support for admin/volume ingress and fix UI links (#8679)

2026-03-18 13:20:55 -07:00

postgres

fix(postgres): prevent uint32 underflow & OOM in message parsing (#10099)

2026-06-24 20:05:43 -07:00

volume_server_ui

fix: EC UI template error when viewing shard details (#7955)

2026-01-03 22:45:48 -08:00

common_test.go

fix: avoid reading upload body when writing JSON errors (#10073)

2026-06-23 20:20:11 -07:00

common.go

fix: avoid reading upload body when writing JSON errors (#10073)

2026-06-23 20:20:11 -07:00

filer_grpc_server_admin.go

grpc: don't tear down the shared master connection on a caller's own timeout (#9775)

2026-06-01 15:11:02 -07:00

filer_grpc_server_chunk_condition_test.go

filer: conditional UpdateEntry with a chunk-set write condition (#10382)

2026-07-21 00:19:15 -07:00

filer_grpc_server_condition_test.go

filer: conditional UpdateEntry with a chunk-set write condition (#10382)

2026-07-21 00:19:15 -07:00

filer_grpc_server_condition.go

filer: conditional UpdateEntry with a chunk-set write condition (#10382)

2026-07-21 00:19:15 -07:00

filer_grpc_server_create_lock_test.go

filer: serialize same-path mutations with a per-path lock (#9639)

2026-05-23 14:22:42 -07:00

filer_grpc_server_dlm_test.go

dlm: resilient distributed locks via consistent hashing + backup replication (#8860)

2026-03-30 23:29:56 -07:00

filer_grpc_server_dlm.go

dlm: resilient distributed locks via consistent hashing + backup replication (#8860)

2026-03-30 23:29:56 -07:00

filer_grpc_server_kv.go

chore: execute goimports to format the code (#7983)

2026-01-07 13:06:08 -08:00

filer_grpc_server_mount_peer_test.go

chore(filer): remove -mount.p2p flag; registry is always on (#9183)

2026-04-21 23:00:11 -07:00

filer_grpc_server_mount_peer.go

chore(filer): remove -mount.p2p flag; registry is always on (#9183)

2026-04-21 23:00:11 -07:00

filer_grpc_server_object_txn_test.go

s3: tear down the emptied .versions directory on last-version delete; drain existing residue (#10278)

2026-07-08 18:50:54 -07:00

filer_grpc_server_object_txn_ttl_test.go

[filer] applyStorageDefaultsToEntry before CreateEntry (#10196)

2026-07-02 11:56:49 -07:00

filer_grpc_server_posix_lock_test.go

filer: warm-up + fail-closed cooling for POSIX locks on owner (re)start (#9673)

2026-05-25 13:14:05 -07:00

filer_grpc_server_posix_lock.go

filer: warm-up + fail-closed cooling for POSIX locks on owner (re)start (#9673)

2026-05-25 13:14:05 -07:00

filer_grpc_server_recompute_test.go

filer: replicate RECOMPUTE_LATEST pointer updates to peers (#9840)

2026-06-06 18:02:28 -07:00

filer_grpc_server_remote.go

mount: version open file handles by filer log position (#10403)

2026-07-23 17:44:02 -07:00

filer_grpc_server_rename_test.go

mount: version open file handles by filer log position (#10403)

2026-07-23 17:44:02 -07:00

filer_grpc_server_rename.go

mount: version open file handles by filer log position (#10403)

2026-07-23 17:44:02 -07:00

filer_grpc_server_stream_mutate_bench_test.go

perf(filer): parallelize StreamMutateEntry with path-keyed scheduler (#9171)

2026-04-21 11:25:09 -07:00

filer_grpc_server_stream_mutate_scheduler_test.go

perf(filer): parallelize StreamMutateEntry with path-keyed scheduler (#9171)

2026-04-21 11:25:09 -07:00

filer_grpc_server_stream_mutate_scheduler.go

perf(filer): parallelize StreamMutateEntry with path-keyed scheduler (#9171)

2026-04-21 11:25:09 -07:00

filer_grpc_server_stream_mutate.go

perf(filer): parallelize StreamMutateEntry with path-keyed scheduler (#9171)

2026-04-21 11:25:09 -07:00

filer_grpc_server_sub_meta_prefilter_test.go

Cut per-subscriber replay decode and widen replay concurrency (#9917)

2026-06-10 13:08:34 -07:00

filer_grpc_server_sub_meta_test.go

Cut per-subscriber replay decode and widen replay concurrency (#9917)

2026-06-10 13:08:34 -07:00

filer_grpc_server_sub_meta.go

generate vtproto marshalers for filer_pb and use them on the metadata log path (#10337)

2026-07-15 02:32:05 -07:00

filer_grpc_server_subscribers.go

admin: add connected Mount Clients page and dashboard section (#9968)

2026-06-14 21:44:10 -07:00

filer_grpc_server_test.go

fix(filer): apply default disk type after location-prefix resolution in gRPC AssignVolume (#8836)

2026-03-29 14:18:24 -07:00

filer_grpc_server_traverse_meta_test.go

filer: bound TraverseBfsMetadata memory by queuing directory paths (#9814)

2026-06-03 10:28:42 -07:00

filer_grpc_server_traverse_meta.go

filer: bound TraverseBfsMetadata memory by queuing directory paths (#9814)

2026-06-03 10:28:42 -07:00

filer_grpc_server.go

mount: version open file handles by filer log position (#10403)

2026-07-23 17:44:02 -07:00

filer_jwt_test.go

[s3] validate indirect filer path inputs (#9931)

2026-06-11 21:56:16 -07:00

filer_server_handlers_copy_test.go

Use filer-side copy for mounted whole-file copy_file_range (#8747)

2026-03-23 18:35:15 -07:00

filer_server_handlers_copy.go

security: add BearerPrefix constant for Authorization headers (#10101)

2026-06-24 19:36:42 -07:00

filer_server_handlers_iam_grpc_test.go

filer/iam-grpc: make admin Bearer auth opt-in (fixes #9509) (#9514)

2026-05-15 13:15:20 -07:00

filer_server_handlers_iam_grpc.go

filer/iam-grpc: make admin Bearer auth opt-in (fixes #9509) (#9514)

2026-05-15 13:15:20 -07:00

filer_server_handlers_proxy_test.go

filer: reject a proxyChunkId that isn't a well-formed fid (#10436)

2026-07-25 10:42:33 -07:00

filer_server_handlers_proxy.go

filer: reject a proxyChunkId that isn't a well-formed fid (#10436)

2026-07-25 10:42:33 -07:00

filer_server_handlers_read_dir.go

chore: execute goimports to format the code (#7983)

2026-01-07 13:06:08 -08:00

filer_server_handlers_read.go

stats: remote-mount bucket cache hit/miss metrics (#10352)

2026-07-16 16:58:45 -07:00

filer_server_handlers_tagging.go

filer: reuse the caller's fetched entry in CreateEntry (#9645)

2026-05-23 21:40:41 -07:00

filer_server_handlers_write_autochunk.go

filer: reuse the caller's fetched entry in CreateEntry (#9645)

2026-05-23 21:40:41 -07:00

filer_server_handlers_write_merge.go

S3 API: Add SSE-KMS (#7144)

2025-08-21 08:28:07 -07:00

filer_server_handlers_write_upload.go

fix(mount): remove fid pool to stop master over-allocating volumes (#9111)

2026-04-16 15:51:13 -07:00

filer_server_handlers_write.go

[s3] validate indirect filer path inputs (#9931)

2026-06-11 21:56:16 -07:00

filer_server_handlers.go

filer: harden TUS session authorization against cross-prefix access (#10315)

2026-07-11 22:45:28 -07:00

filer_server_rocksdb.go

go fix

2026-02-20 18:42:00 -08:00

filer_server_tus_handlers.go

filer: harden TUS session authorization against cross-prefix access (#10315)

2026-07-11 22:45:28 -07:00

filer_server_tus_idor_test.go

filer: harden TUS session authorization against cross-prefix access (#10315)

2026-07-11 22:45:28 -07:00

filer_server_tus_jwt_test.go

filer: harden TUS session authorization against cross-prefix access (#10315)

2026-07-11 22:45:28 -07:00

filer_server_tus_session.go

filer: harden TUS session authorization against cross-prefix access (#10315)

2026-07-11 22:45:28 -07:00

filer_server.go

fix(filer): apply -filer.disk default to metadata log assigns (#10080)

2026-06-24 10:47:11 -07:00

master_grpc_server_admin_ping_test.go

master: accept volume-server Ping targets on follower masters (#9614)

2026-05-21 10:19:59 -07:00

master_grpc_server_admin.go

shell: show who holds the cluster lock (#10353)

2026-07-17 12:30:42 -07:00

master_grpc_server_assign_test.go

fix(master): let the growth initiator wait instead of shedding itself (#10202)

2026-07-02 15:13:46 -07:00

master_grpc_server_assign.go

master: assign re-picks once after its growth concludes instead of shedding (#10348)

2026-07-16 13:55:38 -07:00

master_grpc_server_cluster.go

chore: execute goimports to format the code (#7983)

2026-01-07 13:06:08 -08:00

master_grpc_server_collection.go

…

master_grpc_server_raft_test.go

Add cluster.raft.leader.transfer command for graceful leader change (#7819)

2025-12-19 00:15:39 -08:00

master_grpc_server_raft.go

fix(admin): fix master leader link showing incorrect port in Admin UI (#8924)

2026-04-04 11:50:43 -07:00

master_grpc_server_test.go

fix(master): notify clients after manual volume grow (#9656)

2026-06-01 20:33:37 -07:00

master_grpc_server_volume.go

master: statistics used size covers all collections and layouts (#10319)

2026-07-12 12:56:10 -07:00

master_grpc_server.go

volume.balance: gate on real physical disk usage (fixes #10160) (#10162)

2026-06-30 19:31:12 -07:00

master_server_handlers_admin.go

fix(master): notify clients after manual volume grow (#9656)

2026-06-01 20:33:37 -07:00

master_server_handlers_ui.go

hide millseconds in up time (#7553)

2025-11-26 08:01:19 -08:00

master_server_handlers.go

master: assign re-picks once after its growth concludes instead of shedding (#10348)

2026-07-16 13:55:38 -07:00

master_server.go

security: hot-reload JWT signing keys on SIGHUP (#9826)

2026-06-04 22:26:08 -07:00

raft_common.go

fix: improve raft leader election reliability and failover speed (#8692)

2026-03-18 23:28:07 -07:00

raft_hashicorp_test.go

Normalize hashicorp raft peer ids (#8253)

2026-02-09 07:46:34 -08:00

raft_hashicorp.go

fix: improve raft leader election reliability and failover speed (#8692)

2026-03-18 23:28:07 -07:00

raft_server_handlers.go

fix(wdclient,volume): compare master leader with ServerAddress.Equals (#9089)

2026-04-15 12:29:31 -07:00

raft_server.go

go fmt

2026-04-10 17:31:14 -07:00

volume_grpc_admin.go

volume server: route VolumeMarkReadonly to raft leader (#10120)

2026-06-26 14:22:57 -07:00

volume_grpc_batch_delete_test.go

volume: require admin auth on BatchDelete (#9438)

2026-05-11 13:50:48 -07:00

volume_grpc_batch_delete.go

fix(volume): reject overflowing needle ID deltas (#10342)

2026-07-15 23:24:04 -07:00

volume_grpc_client_to_master_test.go

volume server: route VolumeMarkReadonly to raft leader (#10120)

2026-06-26 14:22:57 -07:00

volume_grpc_client_to_master.go

volume server: route VolumeMarkReadonly to raft leader (#10120)

2026-06-26 14:22:57 -07:00

volume_grpc_copy_incremental.go

…

volume_grpc_copy_verify_test.go

fix(replication): verify-before-destroy in VolumeCopy, check.disk, and over-replication trim (#9943)

2026-06-13 20:05:33 -07:00

volume_grpc_copy_writefile_test.go

EC bitrot follow-ups: protect destination sidecar on optional copy; cap sidecar block_size (#9763)

2026-05-31 23:42:33 -07:00

volume_grpc_copy.go

shell: volume.tier.upload keeps volume replicas (#10314)

2026-07-11 13:49:36 -07:00

volume_grpc_ec_generation_fence_test.go

fix(ec): fence stale-worker EC shard cleanup by encode generation (#9953)

2026-06-14 01:54:04 -07:00

volume_grpc_ec_shared_index_test.go

ec: remove .ecsum sidecars on destroy / shard delete; align Go and Rust cleanup (#10307)

2026-07-10 22:06:36 -07:00

volume_grpc_erasure_coding_recover_test.go

ec: recover EC shards whose .ecx index lives only on a peer server (#10108)

2026-06-25 10:38:14 -07:00

volume_grpc_erasure_coding_recover.go

ec: recover EC shards whose .ecx index lives only on a peer server (#10108)

2026-06-25 10:38:14 -07:00

volume_grpc_erasure_coding_test.go

ec: remove .ecsum sidecars on destroy / shard delete; align Go and Rust cleanup (#10307)

2026-07-10 22:06:36 -07:00

volume_grpc_erasure_coding.go

EC decode: read shards with the encode-time block layout (#10385)

2026-07-21 08:59:14 -07:00

volume_grpc_query.go

fix(volume): reject overflowing needle ID deltas (#10342)

2026-07-15 23:24:04 -07:00

volume_grpc_read_all.go

volume: require admin auth on ReadAllNeedles and VolumeNeedleStatus (#9437)

2026-05-11 13:50:19 -07:00

volume_grpc_read_write.go

Export gRPC file_{read,write}_failures metrics on volume servers. (#9177)

2026-04-22 11:22:21 -07:00

volume_grpc_remote_test.go

volume: gate FetchAndWriteNeedle behind admin auth and refuse internal endpoints (#9441)

2026-05-12 10:11:20 -07:00

volume_grpc_remote.go

[volume] preserve compression state during replication (#9946)

2026-06-13 21:52:59 -07:00

volume_grpc_scrub.go

ec: expose force_deleted_needles_check in ScrubEcVolume RPC and shell (#10176)

2026-06-30 23:20:50 -07:00

volume_grpc_state.go

Add a version token on RPCs to read/update volume server states. (#8191)

2026-02-06 10:58:43 -08:00

volume_grpc_tail.go

Block RPC write operations on volume servers when maintenance mode is enabled (#8115)

2026-02-02 13:21:02 -08:00

volume_grpc_tier_download_test.go

volume: clear remote flag when tiering a volume back to local (#10262)

2026-07-07 23:03:17 -07:00

volume_grpc_tier_download.go

volume: clear remote flag when tiering a volume back to local (#10262)

2026-07-07 23:03:17 -07:00

volume_grpc_tier_test.go

[volume] preserve volume data mtime across tier moves (#9947)

2026-06-13 15:11:39 -07:00

volume_grpc_tier_upload.go

[volume] preserve volume data mtime across tier moves (#9947)

2026-06-13 15:11:39 -07:00

volume_grpc_vacuum.go

fix(volume): add authentication to destructive gRPC admin endpoints (#8876)

2026-05-04 21:14:55 -07:00

volume_server_handlers_admin.go

chore: remove ~50k lines of unreachable dead code (#8913)

2026-04-03 16:04:27 -07:00

volume_server_handlers_helper.go

…

volume_server_handlers_read.go

Export file_read_invalid_needles metric for REST read requests on invalid file IDs. (#9241)

2026-04-27 12:22:42 -07:00

volume_server_handlers_ui.go

hide millseconds in up time (#7553)

2025-11-26 08:01:19 -08:00

volume_server_handlers_write.go

fix(volume): reject overflowing needle ID deltas (#10342)

2026-07-15 23:24:04 -07:00

volume_server_handlers.go

security: hot-reload JWT signing keys on SIGHUP (#9826)

2026-06-04 22:26:08 -07:00

volume_server_parse_path_test.go

fix(volume): reject overflowing needle ID deltas (#10342)

2026-07-15 23:24:04 -07:00

volume_server.go

security: hot-reload JWT signing keys on SIGHUP (#9826)

2026-06-04 22:26:08 -07:00

webdav_server.go

mount: version open file handles by filer log position (#10403)

2026-07-23 17:44:02 -07:00

wrapped_webdav_fs_test.go

[s3] validate indirect filer path inputs (#9931)

2026-06-11 21:56:16 -07:00

wrapped_webdav_fs.go

[s3] validate indirect filer path inputs (#9931)

2026-06-11 21:56:16 -07:00