andrhamm / marcopolo Goto Github PK

Hello!

I don't use this middleware, but wanted to alert you of the issue, as thread safety defects in rack middleware can present a high security risk due to the potential risk of swapping data for concurrent requests.

In the middleware, an instance variable, @request, is set and used in the rack middleware to interact with the active request:

If two or more concurrent requests are received at the same time, a server using threading rather than forking for request handling (e.g. puma), may result in the @request variable being replaced mid-request by a subsequent, concurrent request passing through the same middleware in a different thread.

Instead, use a local variable and pass the request variable to any methods that need to use it as part of handling the request. This will make the middleware threadsafe.

It would be really useful to be able to catch the raw HTTP logs during an explicit block like so:

requests, responses = Marcopolo.capture do
      # requests to APIs
end

In this example, requests and responses would be arrays containing simplified hashes of the respective requests and responses. So requests[0]'s response would be found in responses[0].

The requests would still be logged to the marcopolo logs (if configured to do so).