Populiaru: Duomenys atnaujinti: 2026 m. lapkričio 4 d.

Kategorijos

Internetas1 367
Bendravimas322
Garsas ir vaizdas908
Grafika ir dizainas545
Biuras ir produktyvumas1 132
Kūrėjų įrankiai3 156
DI įrankiai539
Sauga ir privatumas392
Sistemos įrankiai3 151
Žaidimai529
Švietimas ir mokslas240
Tinklas ir IT287

openapi-oathkeeper: senesnės versijos atsisiųsti

Generate Ory Oathkeeper access rules from an OpenAPI 3 contract.

Sąraše – 4 versijos programos openapi-oathkeeper, nuo 2026 m. kovo 19 d. iki dabartinės 0.8.0. Kiekviena veda į diegimo failus leidėjo serveryje.

2026: 4 4 26
VersijaDataDydisFailai
0.8.0Naujausia 2026 m. rugsėjo 9 d. — 64 bitų ZIP32 bitų ZIP
Laidos pastabos
## What's Changed

• Add integration tests by @emmanuelgautier in https://github.com/cerberauth/openapi-oathkeeper/pull/143
• feat:update dependencies and image version by @emmanuelgautier in https://github.com/cerberauth/openapi-oathkeeper/pull/144
• Capture array and object path params as explicit types by @emmanuelgautier in https://github.com/cerberauth/openapi-oathkeeper/pull/145

**Full Changelog**:https://github.com/cerberauth/openapi-oathkeeper/compare/v0.7.19...v0.8.0
0.7.19 2026 m. rugsėjo 7 d. — 64 bitų ZIP32 bitų ZIP
Laidos pastabos
## Security fix

**High severity:** Overbroad path-parameter regex in generated Ory Oathkeeper access rules could cause an authentication/authorization bypass.

Previously, every OpenAPI `string` path parameter (and any parameter type the generator couldn't classify) was compiled to the unanchored regex token `<.+>`. Because `.` matches `/` in Go's regexp engine — and in Ory Oathkeeper's `regexp` matching strategy — a rule generated for a single path segment (e.g. `/public/{slug}`) also matched deeper, unrelated paths under the same prefix (e.g. `/public/admin/delete-all-users`). If those deeper paths weren't defined as their own, more specific OpenAPI operations, the broader (often unauthenticated `noop`) rule would match and proxy them instead of being rejected.

Generated rules for `string` and unclassified path parameters now use `<[^/]+>`, anchored to a single URL segment, matching the behavior already documented for numeric parameters.

**Action required:** Regenerate your Ory Oathkeeper access rules with this version and redeploy them. Rules generated by earlier versions using `string` path parameters may be broader than intended.

See [GHSA-9f3w-vm54-7gfc](https://github.com/cerberauth/openapi-oathkeeper/security/advisories/GHSA-9f3w-vm54-7gfc) for full details. Thanks to @EQSTLab for the responsible disclosure.

## What's Changed

• fix(generator):anchor string path-parameter regex to a single URL segment by @emmanuelgautier in https://github.com/cerberauth/openapi-oathkeeper/pull/142

**Full Changelog**:https://github.com/cerberauth/openapi-oathkeeper/compare/v0.7.18...v0.7.19
0.7.18 2026 m. rugpjūčio 13 d. — 64 bitų ZIP32 bitų ZIP
0.7.15 2026 m. kovo 19 d. — 64 bitų ZIP32 bitų ZIP

Populiariausios kategorijoje „Kalbos ir SDK“

Rodyti viską
  1. LLVMKalbos ir SDK · LLVM
  2. DenoKalbos ir SDK · Deno Land Inc.
  3. CMakeKalbos ir SDK · Kitware
  4. YarnKalbos ir SDK · Yarn Contributors
  5. CcacheKalbos ir SDK · Joel Rosdahl
  6. sbtKalbos ir SDK · Lightbend, Inc.
  7. BOINCKalbos ir SDK · Space Sciences Laboratory, U.C. Berkeley
  8. Dart SDKKalbos ir SDK · Google
  9. TelegrafKalbos ir SDK · InfluxData Inc.

Daugiau leidėjo CerberAuth programų

Rodyti viską
  • jwtopKalbos ir SDK · CerberAuth

Bendrinti