Codestin Search App

gaby · 2026-02-09T14:51:06Z

Motivation

Avoid unsafe raw-header substring checks for flash cookie detection to prevent false positives from similarly prefixed cookie names.
Preserve the original short-circuit on empty raw headers to keep the hot path fast and avoid unnecessary cookie parsing.

Description

Replace bytes.Contains(rawHeaders, ...) with hasFlashCookie(header *fasthttp.RequestHeader) that uses header.Cookie(FlashCookieName) for exact cookie lookup.
Reintroduced the len(rawHeaders) > 0 short-circuit before invoking the exact cookie check in both request handling branches.
Add Test_hasFlashCookieExactMatch to ensure fiber_flashX does not trigger detection while fiber_flash does.
Regenerated minor context interface docs in ctx_interface_gen.go clarifying Request/Response/Value behavior when a context is released.

gemini-code-assist · 2026-02-09T14:51:30Z

Summary of Changes

Hello @gaby, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a bug in flash cookie detection by refactoring the logic to use an exact cookie lookup instead of a substring search on raw headers. This change enhances the reliability of cookie identification, prevents potential false positives, and maintains performance by preserving an early exit for requests without headers. Additionally, it includes minor documentation updates for context handling within the framework.

Highlights

Flash Cookie Detection Logic: Replaced an unsafe raw-header substring check for flash cookie detection with a more precise method using header.Cookie(FlashCookieName), preventing false positives from similarly named cookies.
Performance Optimization: Reintroduced a short-circuit check (len(rawHeaders) > 0) before performing the cookie lookup, ensuring that requests without headers avoid unnecessary cookie parsing and maintain a fast path.
Documentation Updates: Updated the ctx_interface_gen.go file to clarify the behavior of Request(), Response(), and Value() methods, specifically that they return nil when the context has been released.
New Test Case: Added Test_hasFlashCookieExactMatch to validate the new flash cookie detection logic, ensuring it correctly identifies the exact fiber_flash cookie and ignores similar prefixes like fiber_flashX.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

ctx_interface_gen.go
- Added documentation to Request() and Response() methods indicating they return nil if the context has been released.
- Updated documentation for the Value() method to clarify it returns nil if the context has been released and c.fasthttp is nil.
router.go
- Removed the bytes package import as it is no longer needed for cookie detection.
- Deleted the flashCookieNameBytes global variable.
- Replaced bytes.Contains(rawHeaders, flashCookieNameBytes) with a call to the new hasFlashCookie function for more accurate flash cookie detection.
- Introduced a new private function hasFlashCookie(header *fasthttp.RequestHeader) which uses header.Cookie(FlashCookieName) for exact cookie lookup.
router_test.go
- Added Test_hasFlashCookieExactMatch to verify the new hasFlashCookie function's behavior, ensuring it only matches the exact FlashCookieName.

Activity

The author ran make audit, which reported 12 Go standard-library vulnerabilities with toolchain go1.25.1.
Code generation was successfully completed via make generate.
Code alignment (make betteralign), modernization (make modernize), and formatting (make format) checks all succeeded.
Linting (make lint) completed with 0 issues.
All tests (make test) passed, with 2676 tests run and 2 skipped (related to sync.Pool reuse assertion and a Windows-only static path traversal test).
The pull request is linked to a Codex Task for context.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

codecov · 2026-02-09T14:52:52Z

Codecov Report

❌ Patch coverage is 88.88889% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 91.03%. Comparing base (04a44f9) to head (dd32efb).
⚠️ Report is 25 commits behind head on main.

Files with missing lines	Patch %	Lines
router.go	50.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4078      +/-   ##
==========================================
- Coverage   91.03%   91.03%   -0.01%     
==========================================
  Files         119      119              
  Lines       11243    11261      +18     
==========================================
+ Hits        10235    10251      +16     
- Misses        637      638       +1     
- Partials      371      372       +1

Flag	Coverage Δ
unittests	`91.03% <88.88%> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

Pull request overview

This PR hardens Fiber’s flash-cookie detection to avoid false positives from similarly prefixed cookie names, while preserving the existing short-circuit behavior around header inspection in the request handler.

Changes:

Replace raw-header substring matching with an exact cookie lookup via RequestHeader.Cookie(FlashCookieName).
Keep the existing len(rawHeaders) > 0 guard before attempting flash-cookie detection in both request handler branches.
Add a regression test ensuring fiber_flashX does not trigger flash-cookie detection, while fiber_flash does; regenerate context interface docs to clarify released-context behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
`router.go`	Switch flash-cookie detection to exact cookie lookup and restore the empty-raw-headers short-circuit.
`router_test.go`	Add test coverage for exact-match flash-cookie detection to prevent prefixed-cookie false positives.
`ctx_interface_gen.go`	Update generated interface docs to clarify `Request/Response/Value` behavior after context release.

router.go

gemini-code-assist

Code Review

This pull request addresses a bug related to flash cookie detection by replacing unsafe raw-header substring checks with a more precise cookie lookup method. It also restores a short-circuit for empty raw headers to optimize performance. Additionally, it includes documentation updates for context interface methods and a new test case to ensure accurate flash cookie detection. The changes aim to improve security, maintain performance, and enhance code clarity.

router.go

ctx_interface_gen.go

router_test.go

router.go

ReneWerner87

pls check the performance for this change

coderabbitai · 2026-02-11T08:31:55Z

Walkthrough

Documentation for the Ctx interface is updated to describe behavior when context is released. A new hasFlashCookie() utility function is introduced in redirect.go for efficient flash cookie detection. Router.go is refactored to use this centralized check. Test coverage is added for the new function.

Changes

Cohort / File(s)	Summary
Documentation Updates `ctx_interface_gen.go`	Updated comments for `Request()`, `Response()`, and `Value()` methods to document behavior when context is released (returning nil values).
Flash Cookie Detection `redirect.go`, `router.go`	Introduced `hasFlashCookie()` utility function with precomputed byte sequence needle for efficient flash cookie detection; replaced manual header inspection with centralized function calls in request handling paths.
Tests & Manifest `router_test.go`, `go.mod`	Added test `Test_hasFlashCookieExactMatch` to validate flash cookie detection logic with exact and synthetic headers; updated manifest.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

♻️ refactor: Optimize string handling and memory allocations #3922 — Modifies flash-cookie detection and request-header handling in router.go with overlapping functionality.
🐛 bug: Remove Flash Cookie from Response headers after parsing #3840 — Updates parseAndClearFlashMessages() to work alongside the new flash cookie precheck added in this PR.
📚 Doc: Updates to Context documentation #3206 — Updates Ctx interface documentation (docs/api/ctx.md) in parallel with inline comment updates here.

Suggested reviewers

sixcolors
efectn

Poem

🐰 A flash cookie hopper, now optimized with care,
No needless parsing through headers in the air,
With hasFlashCookie() keeping the fast path bright,
And ctx behavior now documented right,
The router bounces with joy—everything's light! ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: hardening flash cookie detection to prevent false positives from substring matching.
Description check	✅ Passed	The description provides clear motivation, describes the changes made, includes test additions, and aligns with the PR objectives, but lacks explicit checklist completion and detailed sections from the template.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch replace-cookie-lookup-in-router.go

No actionable comments were generated in the recent review. 🎉

Tip

Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Add header length check for flash cookie

9fc4b31

gaby requested a review from a team as a code owner February 9, 2026 14:51

gaby requested review from ReneWerner87, Copilot, efectn and sixcolors February 9, 2026 14:51

gaby added the codex label Feb 9, 2026 — with ChatGPT Codex Connector

ReneWerner87 added v3 ☢️ Bug labels Feb 9, 2026

ReneWerner87 added this to v3 Feb 9, 2026

ReneWerner87 added this to the v3 milestone Feb 9, 2026

gaby changed the title ~~🐛 bug: restore header short-circuit and tighten flash cookie detection~~ 🐛 bug: harden flash cookie detection Feb 9, 2026

Copilot started reviewing on behalf of gaby February 9, 2026 14:51 View session

Copilot AI reviewed Feb 9, 2026

View reviewed changes

router.go Outdated Show resolved Hide resolved

router.go Outdated Show resolved Hide resolved

gemini-code-assist bot reviewed Feb 9, 2026

View reviewed changes

efectn reviewed Feb 9, 2026

View reviewed changes

router.go Outdated Show resolved Hide resolved

ReneWerner87 approved these changes Feb 10, 2026

View reviewed changes

ReneWerner87 requested changes Feb 10, 2026

View reviewed changes

perf: optimize flash cookie lookup in request handling

dd32efb

ReneWerner87 approved these changes Feb 11, 2026

View reviewed changes

ReneWerner87 merged commit 7b92748 into main Feb 11, 2026
16 of 17 checks passed

ReneWerner87 deleted the replace-cookie-lookup-in-router.go branch February 11, 2026 13:44

github-project-automation bot moved this to Done in v3 Feb 11, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

🐛 bug: harden flash cookie detection#4078

🐛 bug: harden flash cookie detection#4078
ReneWerner87 merged 2 commits intomainfrom
replace-cookie-lookup-in-router.go

gaby commented Feb 9, 2026 •

edited

Loading

Uh oh!

gemini-code-assist bot commented Feb 9, 2026

Uh oh!

codecov bot commented Feb 9, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ReneWerner87 left a comment

Uh oh!

coderabbitai bot commented Feb 11, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

gaby commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Description

Uh oh!

gemini-code-assist bot commented Feb 9, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

codecov bot commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ReneWerner87 left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

gaby commented Feb 9, 2026 •

edited

Loading

codecov bot commented Feb 9, 2026 •

edited

Loading

coderabbitai bot commented Feb 11, 2026 •

edited

Loading