Preparing for 0.9.4 patch release by paras-gupta2 · Pull Request #316 · hashicorp/consul-ecs

paras-gupta2 · 2026-03-02T08:21:01Z

Changes proposed in this PR:

Backport of following PRs in main:
Updated version add changelog as well

Checklist:

Tests added
CHANGELOG entry added

Match LICENSE file.

…quick-anteater Add artifacts manifest (automatically generated)

[SecVul] Update aws-sdk-go

* Consume latest version of consul-awsauth dependency * Update CHANGELOG.md

* Remove excess logs in health-sync * Added changelog

* Fix vulnerabiility * Added changelog * Update Dockerfile * Updated golangci-lint version to 1.60.1

--------- Co-authored-by: João Rafael <joaoraf@me.com>

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.33.0 to 0.38.0. - [Commits](golang/net@v0.33.0...v0.38.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.38.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Vikramarjuna <vkrmrjun@gmail.com>

Pin `docker/setup-qemu-action` to specific commit for stability.

[Compliance] - PR Template Changes Required

Signed-off-by: Manisha Kumari <manisha.kumari@hashicorp.com>

Test with latest consul versions

Testing test cases with latest consul version

…elog

Fix AWS SDK v1 CVE

github-advanced-security · 2026-03-02T08:21:04Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

github-advanced-security · 2026-03-02T08:21:04Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

github-advanced-security · 2026-03-02T08:21:04Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

github-advanced-security · 2026-03-02T08:21:04Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

github-advanced-security · 2026-03-02T08:21:04Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

github-advanced-security · 2026-03-02T08:21:04Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

github-advanced-security · 2026-03-02T08:21:04Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

github-advanced-security · 2026-03-02T08:21:04Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

github-advanced-security · 2026-03-02T08:21:04Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

 	<Message>Fake AWS Server Error: %s</Message>
  </Error>
-</ErrorResponse>`, msg)
+</ErrorResponse>`, msg); writeErr != nil {


In general, to prevent reflected XSS when including user-controlled data in an XML/HTML response, you should apply proper contextual escaping before writing the data to the response body. For XML text nodes, escaping characters like <, >, &, ', and " is sufficient; in Go, xml.EscapeText is the appropriate standard-library helper.

Here, the vulnerable behavior is in writeError in testutil/iamauthtest/testing.go, where msg := fmt.Sprintf("%s %s", r.Method, r.URL) is interpolated directly into the <Message> element. The safest, minimal-impact fix is:

Convert the formatted message msg to a byte slice.

Pass it through xml.EscapeText into a bytes.Buffer (or similar) to produce an escaped version safe for inclusion in XML text.

Use that escaped string in the fmt.Fprintf call instead of the raw msg.

This requires:

Adding an import for bytes (new) and reusing the existing encoding/xml import.

Updating writeError to escape msg via xml.EscapeText and handle any (unlikely) error; on error, we can fall back to a generic static message rather than echoing unescaped input.

No other functionality changes: the error structure and status codes remain the same; only the internal content is now XML-escaped.

@@ -1 +1 @@
-1.22.7
+1.25.5


@@ -1 +1 @@
-1.22.7
+1.25.5


@@ -1 +1 @@
-1.22.7
+1.25.5


@@ -1 +1 @@
-1.22.7
+1.25.5


Copilot

Pull request overview

Prepares the 0.9.4 patch release branch by backporting security and feature work from main, including AWS SDK v2 migration, network partition resilience configuration, and CI/release pipeline updates.

Changes:

Migrates AWS integrations from AWS SDK v1 to v2 across controller/health-sync/test utilities.
Adds network partition resilience configuration (outlier detection/passive health checks) and corresponding mesh-init logic + tests.
Updates build/release tooling (GitHub Actions, Dockerfile, Makefile, lint config) and refreshes dependencies + headers/changelog.

Reviewed changes

Copilot reviewed 85 out of 86 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
version/version_test.go	Copyright header update.
version/version.go	Replace string replace call with `ReplaceAll`; header update.
version/non_fips_build.go	Copyright header update.
version/fips_build.go	Copyright header update.
testutil/iamauthtest/testing.go	Handle HTTP response write errors; header update.
testutil/iamauthtest/responses.go	Copyright header update.
testutil/iamauthtest/arn.go	Copyright header update.
testutil/fake-command.go	Copyright header update.
testutil/consul.go	Copyright header update.
testutil/config.go	Copyright header update.
testutil/aws.go	Safer env var set/unset in tests; header update.
subcommand/version/command.go	Copyright header update.
subcommand/net-dial/command_test.go	Close error handling in tests; header update.
subcommand/net-dial/command.go	Close error handling; header + imports update.
subcommand/mesh-init/command_test.go	Adds tests for service-defaults registration/outlier config; header + imports update.
subcommand/mesh-init/command.go	Adds service-defaults registration for resilience mode; header update.
subcommand/mesh-init/checks_test.go	Copyright header update.
subcommand/mesh-init/checks.go	Copyright header update.
subcommand/health-sync/dataplane_monitor.go	Copyright header update.
subcommand/health-sync/command_test.go	Migrates ECS status constants to SDK v2; adds extra assertion loop; header update.
subcommand/health-sync/command.go	Prevents periodic sync after SIGTERM; header update.
subcommand/health-sync/checks_test.go	Migrates ECS status constants to SDK v2; header update.
subcommand/health-sync/checks.go	Migrates ECS status constants to SDK v2; adjusts logging; header update.
subcommand/envoy-entrypoint/task-monitor.go	Copyright header update.
subcommand/envoy-entrypoint/command_windows.go	Copyright header update.
subcommand/envoy-entrypoint/command_unix_test.go	Migrates ECS desired status constants to SDK v2; header update.
subcommand/envoy-entrypoint/command_unix.go	Updates logging flag merge to use embedded flags; header update.
subcommand/envoy-entrypoint/command_common.go	Copyright header update.
subcommand/controller/command_test.go	Moves enterprise policy constant out of OSS test file; header update.
subcommand/controller/command_ent_test.go	Adds enterprise-only policy constant; header update.
subcommand/controller/command.go	Migrates ECS client creation to AWS SDK v2; header update.
subcommand/app-entrypoint/command_windows.go	Copyright header update.
subcommand/app-entrypoint/command_unix_test.go	Removes legacy `+build` tag; header update.
subcommand/app-entrypoint/command_unix.go	Removes legacy `+build` tag; updates logging flag merge; header update.
subcommand/app-entrypoint/command_common.go	Copyright header update.
scan.hcl	Copyright header update.
main.go	Copyright header update.
logging/logger_test.go	Copyright header update.
logging/logger.go	Copyright header update.
internal/redirecttraffic/redirect_traffic_test.go	Copyright header update.
internal/redirecttraffic/redirect_traffic.go	Copyright header update.
internal/dns/dns_test.go	Copyright header update.
internal/dns/dns.go	Copyright header update.
internal/dataplane/dataplane_json.go	Copyright header update.
internal/dataplane/dataplane_config_test.go	Copyright header update.
internal/dataplane/dataplane_config.go	Copyright header update.
hack/generate-config-reference/schema.go	Copyright header update.
hack/generate-config-reference/main.go	Copyright header update.
go.sum	Dependency updates for AWS SDK v2 + other bumps.
go.mod	Switches to AWS SDK v2 modules; updates dependency versions; bumps Go version directive.
entrypoint/cmd.go	Removes legacy `+build` tag; uses embedded exec.Cmd methods; header update.
controller/resource_test.go	Migrates ECS task/tag types to SDK v2.
controller/resource.go	Migrates ECS list/describe to SDK v2; adds ECS interface; adjusts tag handling.
controller/policy.go	Copyright header update.
controller/mocks/sm_client.go	Migrates Secrets Manager mock to SDK v2-style methods.
controller/mocks/ecs_client.go	Migrates ECS mock to SDK v2-style methods + pagination simulation.
controller/controller_test.go	Copyright header update.
controller/controller.go	Copyright header update.
config/validate_test.go	Copyright header update.
config/validate.go	Copyright header update.
config/types_test.go	Copyright header update.
config/types.go	Adds network resilience + outlier detection config/types/defaults; header update.
config/schema.json	Adds schema for `networkResilienceConfig` and formatting updates.
config/schema.go	Copyright header update.
config/config_test.go	Copyright header update.
config/config.go	Migrates AWS config/credentials handling to SDK v2 for IAM auth login flow.
commands.go	Copyright header update.
build-scripts/version.sh	Copyright header update.
awsutil/awsutil_test.go	Updates tests to use `NewAWSConfig` and SDK v2 status constants; improves env handling.
awsutil/awsutil.go	Replaces v1 session with v2 config + smithy middleware user-agent; closes HTTP body.
Makefile	Allows `ARCH` override with `?=`.
LICENSE	Copyright header update.
Dockerfile	Updates Go build image + Alpine base; adds curl/gnupg upgrade step; adjusts packaging path.
CHANGELOG.md	Adds unreleased notes for backported fixes/security/dependency bumps.
.release/security-scan.hcl	Adds empty triage/suppress block.
.release/consul-ecs-artifacts.hcl	New release artifact manifest file.
.golangci.yml	Updates golangci-lint config for v2 schema + formatters section.
.go-version	Bumps Go toolchain version used by CI.
.github/workflows/test.yml	Runs on PRs; updates Consul test matrix; pins ubuntu-22.04; bumps golangci-lint action/version.
.github/workflows/security-scan.yml	Pins ubuntu-22.04.
.github/workflows/reusable-get-go-version.yml	Pins ubuntu-22.04 (and continues reading `.go-version`).
.github/workflows/build.yml	Runs on PRs; refactors build matrix + introduces Docker-based FIPS builds; pins ubuntu-22.04.
.github/pull_request_template.md	Adds PCI review checklist section.
.github/containers/ubuntu/fips-build-Dockerfile	New Dockerfile to produce glibc-compatible FIPS binaries.
.github/CODEOWNERS	Adds team-consul-platform and expands ownership rules for release configs.
.dockerignore	Tightens build context; attempts to allow required source/artifacts.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-02T08:30:52Z

+* Update Dockerfile to use Alpine 3.19.1 and explicitly upgrade curl and gnupg to mitigate [CVE-2025-14819], [CVE-2025-14524], [CVE-2025-14017], and [CVE-2025-30258].
+* Upgrade `golang.org/x/crypto` to `v0.45.0` to address [GO-2025-4134] and [GO-2025-4116]
+
+IMPROVEMENTS
+* AWS SDK Migration: Migrated core AWS integration from SDK v1 to SDK v2. This improves performance, reduces memory overhead, and adopts modern Go patterns (Context support, non-pointer slice types).
+* Remove info logs from health sync checks
+* Bump Go version to `1.25.7`


Changelog entries mention upgrading to Alpine 3.19.1 and bumping Go to 1.25.7, but the Dockerfile uses Alpine 3.23 and CI .go-version is 1.25.5. Please reconcile these version references so the release notes accurately describe what the release contains.

Suggested change

* Update Dockerfile to use Alpine 3.19.1 and explicitly upgrade curl and gnupg to mitigate [CVE-2025-14819], [CVE-2025-14524], [CVE-2025-14017], and [CVE-2025-30258].

* Upgrade `golang.org/x/crypto` to `v0.45.0` to address [GO-2025-4134] and [GO-2025-4116]

IMPROVEMENTS

* AWS SDK Migration: Migrated core AWS integration from SDK v1 to SDK v2. This improves performance, reduces memory overhead, and adopts modern Go patterns (Context support, non-pointer slice types).

* Remove info logs from health sync checks

* Bump Go version to `1.25.7`

* Update Dockerfile to use Alpine 3.23 and explicitly upgrade curl and gnupg to mitigate [CVE-2025-14819], [CVE-2025-14524], [CVE-2025-14017], and [CVE-2025-30258].

* Upgrade `golang.org/x/crypto` to `v0.45.0` to address [GO-2025-4134] and [GO-2025-4116]

IMPROVEMENTS

* AWS SDK Migration: Migrated core AWS integration from SDK v1 to SDK v2. This improves performance, reduces memory overhead, and adopts modern Go patterns (Context support, non-pointer slice types).

* Remove info logs from health sync checks

* Bump Go version to `1.25.5`

Copilot · 2026-03-02T08:30:52Z

 		for _, task := range tasks.Tasks {
-			if task == nil {
-				s.Log.Warn("task is nil")
+			if task.TaskArn == nil {
+				s.Log.Warn("task has no ARN")
 				continue
 			}
-
-			if !isMeshTask(task) {
+			if !isMeshTask(&task) {
 				s.Log.Debug("skipping non-mesh task", "task-arn", *task.TaskArn)


In for _, task := range tasks.Tasks, taking the address of the range variable (&task) is a common Go pitfall and is flagged by govet in many configurations. Prefer iterating by index (or copying to a new variable) before taking the address when calling isMeshTask.

Copilot · 2026-03-02T08:30:53Z

+// registerServiceDefaults registers service defaults with passive health check
+// for network partition resilience mode. It fetches any existing service defaults,
+// merges the configurations, and only adds passive health check if not already present.
+// If upstreams are defined in the proxy configuration, passive health check is also
+// applied to those specific upstreams via UpstreamConfig.Overrides.
+func (c *Command) registerServiceDefaults(consulClient *api.Client, service *api.AgentService, resilience *config.NetworkPartitionResilienceConfig) error {


The doc comment says passive health check will also be applied to upstream-specific overrides (UpstreamConfig.Overrides), but the implementation below only sets UpstreamConfig.Defaults. Either implement the overrides behavior or update the comment to reflect the current behavior to avoid misleading future maintainers.

Copilot · 2026-03-02T08:30:53Z

 linters:
-  disable-all: true
  enable:
-    - gofmt
    - govet
    - unconvert
    - staticcheck
    - ineffassign
    - unparam


disable-all: true was removed, which can cause golangci-lint to start running its default linter set in addition to the explicitly enabled linters. If the intent is to keep linting stable across releases, consider restoring disable-all: true (or explicitly disabling unwanted defaults) to avoid unexpected CI failures.

Copilot · 2026-03-02T08:30:53Z

@@ -0,0 +1,28 @@
+# Copyright (c) HashiCorp, Inc.


This new release config file still uses the old HashiCorp copyright header, while most files in this PR were updated to IBM. If this repository is standardizing headers, this file should likely be updated to match the new convention for consistency/compliance.

Suggested change

# Copyright (c) HashiCorp, Inc.

# Copyright IBM Corp.

Copilot · 2026-03-02T08:30:54Z

+	if err := conn.Close(); err != nil {
+		fmt.Printf("Warning: failed to close connection: %v\n", err)
+	}


Run uses cli.Ui for user-visible output, but this warning is printed directly to stdout via fmt.Printf. Prefer routing this through c.UI (or the command logger, if available) so output is consistent and easier to test/capture.

Copilot · 2026-03-02T08:30:54Z

+			if !c.missingDataplaneContainer {
+				// Assert that the proxy check remains in the expected state for the full 5 seconds
+				end := time.Now().Add(5 * time.Second)
+				for time.Now().Before(end) {
+					// This will retry for up to 5 seconds, but we want to fail immediately if the status changes
+					assertHealthChecks(t, consulClient, nil, expectedProxyCheck)
+					time.Sleep(100 * time.Millisecond)
+				}
+			}


This adds a fixed 5-second polling loop (with sleeps) to every applicable test run, which will slow the suite and can be flaky under load. Consider using require.Never/require.Eventually (or the existing retry helpers in this package) with a short timeout to assert the status does not change, without busy-waiting for the full duration.

Copilot · 2026-03-02T08:30:54Z

+.DS_Store
+
+# Allow dist and LICENSE for default Dockerfile
 !dist/*


.dockerignore only un-ignores dist/*, but the Dockerfile now expects artifacts under dist/$TARGETOS/$TARGETARCH/... (e.g. dist/linux/amd64/...). With the current patterns, those nested paths will be excluded from the build context and COPY dist/... will fail. Consider changing this to un-ignore dist/** (or !dist/ plus !dist/**) to include the nested directories.

Suggested change

!dist/*

!dist/

!dist/**

Copilot · 2026-03-02T08:30:55Z

+FROM golang:1.23.6-alpine as go-discover
 RUN CGO_ENABLED=0 go install github.com/hashicorp/go-discover/cmd/discover@214571b6a5309addf3db7775f4ee8cf4d264fd5f

-FROM docker.mirror.hashicorp.services/alpine:latest AS release-default
+FROM docker.mirror.hashicorp.services/alpine:3.23 AS release-default



The changelog/PR description call out Alpine 3.19.1, but the Dockerfile is updated to alpine:3.23. Please either update the Dockerfile to the intended version or adjust the changelog entry so the documented base image matches what’s actually shipped.

Copilot · 2026-03-02T08:30:55Z

+    fi
+
+# Install Go
+RUN curl -L https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz | tar -C /opt -zxv


The RUN curl -L https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz | tar -C /opt -zxv step downloads and executes a remote tarball without any checksum or signature verification, which is a supply-chain risk. If the go.dev distribution or the download path were compromised, an attacker could provide a malicious Go toolchain that runs at build time and produces backdoored release binaries. To mitigate this, pin the Go artifact to a specific, trusted checksum (or signature) and verify it before extraction, or use a pre-verified Go toolchain from your base image or package manager instead of an ad-hoc curl+tar install.

jeanneryan and others added 30 commits August 1, 2024 10:29

Add artifacts manifest (automatically generated)

4f3938b

add copyright header

26810d6

Update artifact manifest license header

788f8e3

Match LICENSE file.

Merge branch 'main' into artifact-manifest/main/yearly-quick-anteater

55e05b3

Merge branch 'main' into artifact-manifest/main/yearly-quick-anteater

f6fb1ed

Merge pull request #261 from hashicorp/artifact-manifest/main/yearly-…

ae4ca6f

…quick-anteater Add artifacts manifest (automatically generated)

Update aws-sdk-go

cee6eca

Merge pull request #272 from hashicorp/abhishek/fix-sec-scan-aws

f618946

[SecVul] Update aws-sdk-go

Consume latest version of consul-awsauth dependency (#274)

46744af

* Consume latest version of consul-awsauth dependency * Update CHANGELOG.md

Update CHANGELOG.md after 0.9.0 release (#276)

4719bed

Remove info log from health-sync checks (#277)

43cf580

* Remove excess logs in health-sync * Added changelog

Fix vulnerabilities (#278)

12205e1

* Fix vulnerabiility * Added changelog * Update Dockerfile * Updated golangci-lint version to 1.60.1

update codeowners (#288)

5a4867e

build: updated the runner to ubuntu-22.04 (#287)

28ea956

build: update build workflow to run on pull request to main (#289)

dc3ecc7

fix: add shuttingDown flag to prevent syncChecks after SIGTERM (#290)

c25125b

--------- Co-authored-by: João Rafael <joaoraf@me.com>

Pin docker/setup-qemu-action to specific commit for stability.

34b4fcd

Merge pull request #296 from hashicorp/nitin/sec-vuln-fix

5995ec5

Pin `docker/setup-qemu-action` to specific commit for stability.

[Compliance] - PR Template Changes Required

37eb146

Merge pull request #297 from hashicorp/compliance-template

90d2388

[Compliance] - PR Template Changes Required

updated Codeowners file

1a74e68

Signed-off-by: Manisha Kumari <manisha.kumari@hashicorp.com>

[COMPLIANCE] Update Copyright and License Headers (Batch 1 of 1)

061a3af

Test with latest consul versions

536ff4f

Update consul CE version

02fc18b

Merge pull request #304 from hashicorp/upgrade_consul_version

c601a4f

Test with latest consul versions

Add Security vulnerabilities fix

a3e66d3

Update go version for CI

49d2491

Update golangci-lint version

7f77a9e

Upgrade go version to 1.25.5

8c960be

paras-gupta2 added 12 commits February 25, 2026 14:50

Merge pull request #312 from hashicorp/check/0.9.4

02a9c0d

Testing test cases with latest consul version

Update Dockerfile to fix curl and gnupg vulnerabilities; update chang…

1fe3949

…elog

Upgrading the aws sdk v1 to v2 to resolve lint issue

7c637ac

Upgrading the aws sdk v1 to v2 to resolve lint issue

13a1bbf

fix lint issue

ada86b5

fix issue in awsutil file

ef5110d

fix issues and optimise the sdk v2 changes

4d31c86

Add changelog

07d8cee

Remove commented code

03935db

Upgrade the alpine version of docker to latest

356af4e

Add error handling

fce3387

Merge pull request #314 from hashicorp/prepare/0.9.4

b40e18f

Fix AWS SDK v1 CVE

paras-gupta2 requested a review from a team as a code owner March 2, 2026 08:21

Copilot AI review requested due to automatic review settings March 2, 2026 08:21

paras-gupta2 requested a review from a team as a code owner March 2, 2026 08:21

paras-gupta2 requested a review from mdeggies March 2, 2026 08:21

github-advanced-security AI found potential problems Mar 2, 2026

View reviewed changes

Copilot started reviewing on behalf of paras-gupta2 March 2, 2026 08:21 View session

Copilot AI reviewed Mar 2, 2026

View reviewed changes

paras-gupta2 closed this Mar 2, 2026

@@ -7,6 +7,7 @@
             // https://github.com/hashicorp/consul/blob/76c03872b709297b7649cb3f8999c3d1323361fb/internal/iamauth/iamauthtest/testing.go
             import (
+            	"bytes"
             	"encoding/xml"
             	"fmt"
             	"io"
@@ -82,6 +83,15 @@
             func writeError(w http.ResponseWriter, code int, r *http.Request) {
             	w.WriteHeader(code)
             	msg := fmt.Sprintf("%s %s", r.Method, r.URL)
+            	var buf bytes.Buffer
+            	if err := xml.EscapeText(&buf, []byte(msg)); err != nil {
+            		// Fall back to a generic message if escaping fails
+            		msg = "request could not be processed"
+            	} else {
+            		msg = buf.String()
+            	}
             	if _, writeErr := fmt.Fprintf(w, `<ErrorResponse xmlns="https://fakeaws/">
               <Error>
             	<Message>Fake AWS Server Error: %s</Message>

		@@ -1 +1 @@
		1.22.7
		1.25.5

		@@ -1 +1 @@
		1.22.7
		1.25.5

		@@ -1 +1 @@
		1.22.7
		1.25.5

		@@ -1 +1 @@
		1.22.7
		1.25.5

Conversation

paras-gupta2 commented Mar 2, 2026

Changes proposed in this PR:

Checklist:

Uh oh!

github-advanced-security AI commented Mar 2, 2026

Uh oh!

github-advanced-security AI commented Mar 2, 2026

Uh oh!

github-advanced-security AI commented Mar 2, 2026

Uh oh!

github-advanced-security AI commented Mar 2, 2026

Uh oh!

github-advanced-security AI commented Mar 2, 2026

Uh oh!

github-advanced-security AI commented Mar 2, 2026

Uh oh!

github-advanced-security AI commented Mar 2, 2026

Uh oh!

github-advanced-security AI commented Mar 2, 2026

Uh oh!

github-advanced-security AI commented Mar 2, 2026

Uh oh!

Check warning

Uh oh!

Copilot Autofix

Check warning

Check warning

Check warning

Check warning

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants