Skip to content

fix: preserve legacy BeforeResponse handlers (ExecutionMode == 0)#46

Merged
CypherPotato merged 1 commit into
mainfrom
codex/propose-fix-for-auth-bypass-vulnerability
May 29, 2026
Merged

fix: preserve legacy BeforeResponse handlers (ExecutionMode == 0)#46
CypherPotato merged 1 commit into
mainfrom
codex/propose-fix-for-auth-bypass-vulnerability

Conversation

@CypherPotato
Copy link
Copy Markdown
Member

Motivation

  • Converting RequestHandlerExecutionMode to a [Flags] enum removed a zero-valued member and caused handlers with the default/legacy ExecutionMode == 0 to be silently skipped, which can bypass pre-route handlers such as authentication.

Description

  • Treat ExecutionMode == 0 as a legacy BeforeResponse handler during dispatch by updating the InvokeRequestHandlerGroup conditional to also accept rh.ExecutionMode == 0 && mode == RequestHandlerExecutionMode.BeforeResponse, while preserving the existing HasFlag behavior for current flag values.

Testing

  • Ran a build and attempted dotnet test tests/Sisk.Core/tests.csproj; restore and compilation succeeded but the test run aborted because the execution environment lacks the required .NET 9 runtime (only .NET 10 is installed), so no unit test results were produced.

Codex Task

@CypherPotato CypherPotato merged commit 0622875 into main May 29, 2026
3 of 5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant