mirror of
https://github.com/kerberos-io/onvif.git
synced 2026-08-23 15:08:33 +00:00
d726ed8edb
Critical
- Device.SendSoapWithHeader now parses the supplied header content
with etree and adds each top-level child as its own SOAP Header
block. gosoap.AddStringHeaderContent only accepts a single root
element; previously a multi-child ref-params header silently
produced a header-less request because the parse error was
discarded. Errors are now propagated.
- enrichSOAPErr scrubs <*:Security> blocks from response bodies
before fault extraction or excerpt slicing so a camera that
echoes the WS-Security header in a fault response cannot leak
Username/Password into operator logs.
Important
- extractSOAPFault falls back to the SOAP 1.2 Subcode (e.g.
ter:InvalidArgs) when Reason/Text is empty — consistent with
enrichSOAPErr and surfaces actionable detail on 200-OK fault
bodies reached via unmarshalNode.
- subscriptionRef captures the camera-granted TerminationTime
from CreatePullPointSubscription and Renew responses. renewLoop
schedules from it via the new nextRenewInterval helper so we
never miss a renew when the camera grants less than requested.
renew is now a sleep-loop driven by the latest granted time.
- enrichSOAPErr reads at most 64 KiB from the body (vs. 10 MiB
on success paths). Fault bodies are always small; the prior cap
let a wedged camera churn 10 MiB/s through the retry loop.
Suggestions
- extractReferenceParameters anchors to <SubscriptionReference> so
a wsa:ReplyTo / wsa:FaultTo that also carries ReferenceParameters
elsewhere in the envelope cannot leak through and break PullMessages.
- buildRefParamsHeader accepts either raw children or the full
<*:ReferenceParameters> wrapper, and propagates ancestor xmlns:*
onto each child so a vendor that declares the prefix on the
parent (not the child itself, as AXIS does) still produces valid
standalone children on the wire.
- SendSoapWithHeader documents that xmlHeaderContent must be
well-formed XML and that the caller is responsible for escaping
any externally sourced data.
- Error-message ordering is now context-first
("SOAP fault: X: <wrapped err>") per Go convention.
- Dead headerEnd slicing removed from the SendSoapWithHeader test.
Tests
- End-to-end multi-child wiring through pullMessages.
- Digest auth retry preserves the injected header.
- Malformed-XML header content fast-fails before any request.
- buildRefParamsHeader malformed / whitespace-only edge cases.
- goleak.VerifyTestMain in event/stream catches any pull/renew
goroutine that outlives its Stream.
No new behavioural surface added to onvif core; SendSoap retains
its signature, SendSoapWithHeader is the only new public method.
45 lines
1.7 KiB
Modula-2
45 lines
1.7 KiB
Modula-2
module github.com/kerberos-io/onvif
|
|
|
|
go 1.20
|
|
|
|
require (
|
|
github.com/beevik/etree v1.2.0
|
|
github.com/clbanning/mxj/v2 v2.7.0
|
|
github.com/elgs/gostrgen v0.0.0-20161222160715-9d61ae07eeae
|
|
github.com/gin-gonic/gin v1.9.1
|
|
github.com/google/uuid v1.4.0
|
|
github.com/icholy/digest v0.1.23
|
|
github.com/juju/errors v1.0.0
|
|
github.com/stretchr/testify v1.8.4
|
|
golang.org/x/net v0.19.0
|
|
)
|
|
|
|
require (
|
|
github.com/bytedance/sonic v1.9.1 // indirect
|
|
github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.2 // indirect
|
|
github.com/gin-contrib/sse v0.1.0 // indirect
|
|
github.com/go-playground/locales v0.14.1 // indirect
|
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
|
github.com/go-playground/validator/v10 v10.14.0 // indirect
|
|
github.com/goccy/go-json v0.10.2 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.2.4 // indirect
|
|
github.com/leodido/go-urn v1.2.4 // indirect
|
|
github.com/mattn/go-isatty v0.0.19 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.0.8 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
|
|
github.com/ugorji/go/codec v1.2.11 // indirect
|
|
go.uber.org/goleak v1.3.0 // indirect
|
|
golang.org/x/arch v0.3.0 // indirect
|
|
golang.org/x/crypto v0.16.0 // indirect
|
|
golang.org/x/sys v0.15.0 // indirect
|
|
golang.org/x/text v0.14.0 // indirect
|
|
google.golang.org/protobuf v1.30.0 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|