Merge branch 'main' into fix/csrf-referer-origin-matching

Author: ReneWerner87

.github/workflows/dependabot_automerge.yml

@@ -11,14 +11,13 @@ jobs:
     if: ${{ github.actor == 'dependabot[bot]' }}
     steps:
       - name: Wait for check is finished
-        uses: lewagon/wait-on-check-action@v1.6.1
         id: wait_for_checks
+        uses: poseidon/wait-for-status-checks@v0.6.0
         with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
-          running-workflow-name: wait_for_checks
-          check-regexp: unit
-          repo-token: ${{ secrets.PR_TOKEN }}
-          wait-interval: 10
+          token: ${{ secrets.PR_TOKEN }}
+          match_pattern: ^unit
+          interval: 10
+          timeout: 600
   dependabot:
     needs: [wait_for_checks]
     name: Dependabot auto-merge

app.go

@@ -1213,6 +1213,19 @@ func (app *App) Test(req *http.Request, config ...TestConfig) (*http.Response, e
 		req.Header.Add(HeaderContentLength, strconv.FormatInt(req.ContentLength, 10))
 	}
 
+	// Ensure Host header is present in the dump (required by fasthttp)
+	if req.Host == "" {
+		if req.URL != nil && req.URL.Host != "" {
+			req.Host = req.URL.Host
+		} else {
+			req.Host = "localhost"
+		}
+	}
+
+	// Clear RequestURI so DumpRequest writes origin-form request line with
+	// Host header instead of absolute-form URI without Host header.
+	req.RequestURI = ""
+
 	// Dump raw http request
 	dump, err := httputil.DumpRequest(req, true)
 	if err != nil {

ctx_test.go

@@ -5472,7 +5472,7 @@ func Test_Ctx_SendFile(t *testing.T) {
 
 	// test not modified
 	c = app.AcquireCtx(&fasthttp.RequestCtx{})
-	c.Request().Header.Set(HeaderIfModifiedSince, fI.ModTime().Format(time.RFC1123))
+	c.Request().Header.Set(HeaderIfModifiedSince, fI.ModTime().UTC().Format(http.TimeFormat))
 	err = c.SendFile("ctx.go")
 	// check expectation
 	require.NoError(t, err)

middleware/basicauth/basicauth_test.go

@@ -406,11 +406,13 @@ func Test_BasicAuth_HeaderControlCharEdges(t *testing.T) {
 
 	handler := app.Handler()
 	creds := base64.StdEncoding.EncodeToString([]byte("john:doe"))
+	// Note: \r and \n are sanitized to spaces by fasthttp at the protocol level,
+	// so we use other control chars (SOH, BEL) that pass through unchanged.
 	headers := [][]byte{
-		[]byte("\rBasic " + creds),
-		[]byte("\nBasic " + creds),
-		[]byte("Basic " + creds + "\r"),
-		[]byte("Basic " + creds + "\n"),
+		[]byte("\x01Basic " + creds),
+		[]byte("\x07Basic " + creds),
+		[]byte("Basic " + creds + "\x01"),
+		[]byte("Basic " + creds + "\x07"),
 	}
 
 	for _, h := range headers {

middleware/cache/cache_test.go

@@ -1647,7 +1647,7 @@ func Test_CacheExpiresFutureAllowsCaching(t *testing.T) {
 	var count int
 	app.Get("/", func(c fiber.Ctx) error {
 		count++
-		c.Set(fiber.HeaderExpires, time.Now().Add(30*time.Second).UTC().Format(time.RFC1123))
+		c.Set(fiber.HeaderExpires, time.Now().Add(30*time.Second).UTC().Format(http.TimeFormat))
 		return c.SendString("expires" + strconv.Itoa(count))
 	})
 
@@ -1675,7 +1675,7 @@ func Test_CacheExpiresPastPreventsCaching(t *testing.T) {
 	var count int
 	app.Get("/", func(c fiber.Ctx) error {
 		count++
-		c.Set(fiber.HeaderExpires, time.Now().Add(-1*time.Minute).UTC().Format(time.RFC1123))
+		c.Set(fiber.HeaderExpires, time.Now().Add(-1*time.Minute).UTC().Format(http.TimeFormat))
 		return c.SendString("expires" + strconv.Itoa(count))
 	})
 
@@ -4671,7 +4671,7 @@ func Test_Cache_RequestResponseDirectives(t *testing.T) {
 		app := fiber.New()
 		app.Use(New(Config{Expiration: 1 * time.Hour}))
 		app.Get("/test", func(c fiber.Ctx) error {
-			futureTime := time.Now().Add(1 * time.Hour).Format(time.RFC1123)
+			futureTime := time.Now().Add(1 * time.Hour).UTC().Format(http.TimeFormat)
 			c.Response().Header.Set("Expires", futureTime)
 			return c.SendString("test")
 		})

middleware/session/data.go

@@ -33,6 +33,7 @@ var dataPool = sync.Pool{
 func acquireData() *data {
 	obj := dataPool.Get()
 	if d, ok := obj.(*data); ok {
+		d.Reset()
 		return d
 	}
 	// Handle unexpected type in the pool

middleware/static/static.go

@@ -163,8 +163,16 @@ func New(root string, cfg ...Config) fiber.Handler {
 				prefixLen--
 			}
 
+			// For io/fs.FS, Root must be empty so fasthttp's pathToFilePath
+			// returns clean relative paths without prefixing the root.
+			// PathRewrite already handles file-root and subdirectory cases.
+			fsRoot := root
+			if config.FS != nil {
+				fsRoot = ""
+			}
+
 			fileServer := &fasthttp.FS{
-				Root:                   root,
+				Root:                   fsRoot,
 				FS:                     config.FS,
 				AllowEmptyRoot:         true,
 				GenerateIndexPages:     config.Browse,

res.go

@@ -835,10 +835,6 @@ func (r *DefaultRes) SendFile(file string, config ...SendFile) error {
 			},
 		}
 
-		if cfg.FS != nil {
-			fasthttpFS.Root = "."
-		}
-
 		sf := &sendFileStore{
 			config:  cfg,
 			handler: fasthttpFS.NewRequestHandler(),