Update dependencies

- uses newer version of go-ethereum required for go1.11

vendor/github.com/rs/cors/.travis.yml

@@ -1,6 +1,7 @@
 language: go
 go:
-- 1.8
+- 1.9
+- "1.10"
 - tip
 matrix:
   allow_failures:

vendor/github.com/rs/cors/README.md

@@ -49,6 +49,14 @@ The server now runs on `localhost:8080`:
 
     {"hello": "world"}
 
+### Allow * With Credentials Security Protection
+
+This library has been modified to avoid a well known security issue when configured with `AllowedOrigins` to `*` and `AllowCredentials` to `true`. Such setup used to make the library reflects the request `Origin` header value, working around a security protection embedded into the standard that makes clients to refuse such configuration. This behavior has been removed with [#55](https://github.com/rs/cors/issues/55) and [#57](https://github.com/rs/cors/issues/57).
+
+If you depend on this behavior and understand the implications, you can restore it using the `AllowOriginFunc` with `func(origin string) {return true}`.
+
+Please refer to [#55](https://github.com/rs/cors/issues/55) for more information about the security implications.
+
 ### More Examples
 
 * `net/http`: [examples/nethttp/server.go](https://github.com/rs/cors/blob/master/examples/nethttp/server.go)
@@ -57,6 +65,9 @@ The server now runs on `localhost:8080`:
 * [Negroni](https://github.com/codegangsta/negroni): [examples/negroni/server.go](https://github.com/rs/cors/blob/master/examples/negroni/server.go)
 * [Alice](https://github.com/justinas/alice): [examples/alice/server.go](https://github.com/rs/cors/blob/master/examples/alice/server.go)
 * [HttpRouter](https://github.com/julienschmidt/httprouter): [examples/httprouter/server.go](https://github.com/rs/cors/blob/master/examples/httprouter/server.go)
+* [Gorilla](http://www.gorillatoolkit.org/pkg/mux): [examples/gorilla/server.go](https://github.com/rs/cors/blob/master/examples/gorilla/server.go)
+* [Buffalo](https://gobuffalo.io): [examples/buffalo/server.go](https://github.com/rs/cors/blob/master/examples/buffalo/server.go)
+* [Gin](https://gin-gonic.github.io/gin): [examples/gin/server.go](https://github.com/rs/cors/blob/master/examples/gin/server.go)
 
 ## Parameters
 
@@ -64,8 +75,10 @@ Parameters are passed to the middleware thru the `cors.New` method as follow:
 
 ```go
 c := cors.New(cors.Options{
-    AllowedOrigins: []string{"http://foo.com"},
+    AllowedOrigins: []string{"http://foo.com", "http://foo.com:8080"},
     AllowCredentials: true,
+    // Enable Debugging for testing, consider disabling in production
+    Debug: true,
 })
 
 // Insert the middleware

vendor/github.com/rs/cors/cors.go

@@ -42,7 +42,7 @@ type Options struct {
 	// set, the content of AllowedOrigins is ignored.
 	AllowOriginFunc func(origin string) bool
 	// AllowedMethods is a list of methods the client is allowed to use with
-	// cross-domain requests. Default value is simple methods (GET and POST)
+	// cross-domain requests. Default value is simple methods (HEAD, GET and POST).
 	AllowedMethods []string
 	// AllowedHeaders is list of non simple headers the client is allowed to use with
 	// cross-domain requests.
@@ -52,12 +52,12 @@ type Options struct {
 	// ExposedHeaders indicates which headers are safe to expose to the API of a CORS
 	// API specification
 	ExposedHeaders []string
-	// AllowCredentials indicates whether the request can include user credentials like
-	// cookies, HTTP authentication or client side SSL certificates.
-	AllowCredentials bool
 	// MaxAge indicates how long (in seconds) the results of a preflight request
 	// can be cached
 	MaxAge int
+	// AllowCredentials indicates whether the request can include user credentials like
+	// cookies, HTTP authentication or client side SSL certificates.
+	AllowCredentials bool
 	// OptionsPassthrough instructs preflight to let other potential next handlers to
 	// process the OPTIONS method. Turn this on if your application handles OPTIONS.
 	OptionsPassthrough bool
@@ -69,24 +69,24 @@ type Options struct {
 type Cors struct {
 	// Debug logger
 	Log *log.Logger
-	// Set to true when allowed origins contains a "*"
-	allowedOriginsAll bool
 	// Normalized list of plain allowed origins
 	allowedOrigins []string
 	// List of allowed origins containing wildcards
 	allowedWOrigins []wildcard
 	// Optional origin validator function
 	allowOriginFunc func(origin string) bool
-	// Set to true when allowed headers contains a "*"
-	allowedHeadersAll bool
 	// Normalized list of allowed headers
 	allowedHeaders []string
 	// Normalized list of allowed methods
 	allowedMethods []string
 	// Normalized list of exposed headers
-	exposedHeaders    []string
+	exposedHeaders []string
+	maxAge         int
+	// Set to true when allowed origins contains a "*"
+	allowedOriginsAll bool
+	// Set to true when allowed headers contains a "*"
+	allowedHeadersAll bool
 	allowCredentials  bool
-	maxAge            int
 	optionPassthrough bool
 }
 
@@ -127,7 +127,7 @@ func New(options Options) *Cors {
 				break
 			} else if i := strings.IndexByte(origin, '*'); i >= 0 {
 				// Split the origin in two: start and end string without the *
-				w := wildcard{origin[0:i], origin[i+1 : len(origin)]}
+				w := wildcard{origin[0:i], origin[i+1:]}
 				c.allowedWOrigins = append(c.allowedWOrigins, w)
 			} else {
 				c.allowedOrigins = append(c.allowedOrigins, origin)
@@ -138,7 +138,7 @@ func New(options Options) *Cors {
 	// Allowed Headers
 	if len(options.AllowedHeaders) == 0 {
 		// Use sensible defaults
-		c.allowedHeaders = []string{"Origin", "Accept", "Content-Type"}
+		c.allowedHeaders = []string{"Origin", "Accept", "Content-Type", "X-Requested-With"}
 	} else {
 		// Origin is always appended as some browsers will always request for this header at preflight
 		c.allowedHeaders = convert(append(options.AllowedHeaders, "Origin"), http.CanonicalHeaderKey)
@@ -154,7 +154,7 @@ func New(options Options) *Cors {
 	// Allowed Methods
 	if len(options.AllowedMethods) == 0 {
 		// Default is spec's "simple" methods
-		c.allowedMethods = []string{"GET", "POST"}
+		c.allowedMethods = []string{"GET", "POST", "HEAD"}
 	} else {
 		c.allowedMethods = convert(options.AllowedMethods, strings.ToUpper)
 	}
@@ -174,7 +174,7 @@ func AllowAll() *Cors {
 		AllowedOrigins:   []string{"*"},
 		AllowedMethods:   []string{"HEAD", "GET", "POST", "PUT", "PATCH", "DELETE"},
 		AllowedHeaders:   []string{"*"},
-		AllowCredentials: true,
+		AllowCredentials: false,
 	})
 }
 
@@ -182,7 +182,7 @@ func AllowAll() *Cors {
 // as necessary.
 func (c *Cors) Handler(h http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == "OPTIONS" && r.Header.Get("Access-Control-Request-Method") != "" {
+		if r.Method == http.MethodOptions && r.Header.Get("Access-Control-Request-Method") != "" {
 			c.logf("Handler: Preflight request")
 			c.handlePreflight(w, r)
 			// Preflight requests are standalone and should stop the chain as some other
@@ -204,7 +204,7 @@ func (c *Cors) Handler(h http.Handler) http.Handler {
 
 // HandlerFunc provides Martini compatible handler
 func (c *Cors) HandlerFunc(w http.ResponseWriter, r *http.Request) {
-	if r.Method == "OPTIONS" && r.Header.Get("Access-Control-Request-Method") != "" {
+	if r.Method == http.MethodOptions && r.Header.Get("Access-Control-Request-Method") != "" {
 		c.logf("HandlerFunc: Preflight request")
 		c.handlePreflight(w, r)
 	} else {
@@ -215,7 +215,7 @@ func (c *Cors) HandlerFunc(w http.ResponseWriter, r *http.Request) {
 
 // Negroni compatible interface
 func (c *Cors) ServeHTTP(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
-	if r.Method == "OPTIONS" && r.Header.Get("Access-Control-Request-Method") != "" {
+	if r.Method == http.MethodOptions && r.Header.Get("Access-Control-Request-Method") != "" {
 		c.logf("ServeHTTP: Preflight request")
 		c.handlePreflight(w, r)
 		// Preflight requests are standalone and should stop the chain as some other
@@ -239,7 +239,7 @@ func (c *Cors) handlePreflight(w http.ResponseWriter, r *http.Request) {
 	headers := w.Header()
 	origin := r.Header.Get("Origin")
 
-	if r.Method != "OPTIONS" {
+	if r.Method != http.MethodOptions {
 		c.logf("  Preflight aborted: %s!=OPTIONS", r.Method)
 		return
 	}
@@ -269,7 +269,7 @@ func (c *Cors) handlePreflight(w http.ResponseWriter, r *http.Request) {
 		c.logf("  Preflight aborted: headers '%v' not allowed", reqHeaders)
 		return
 	}
-	if c.allowedOriginsAll && !c.allowCredentials {
+	if c.allowedOriginsAll {
 		headers.Set("Access-Control-Allow-Origin", "*")
 	} else {
 		headers.Set("Access-Control-Allow-Origin", origin)
@@ -297,7 +297,7 @@ func (c *Cors) handleActualRequest(w http.ResponseWriter, r *http.Request) {
 	headers := w.Header()
 	origin := r.Header.Get("Origin")
 
-	if r.Method == "OPTIONS" {
+	if r.Method == http.MethodOptions {
 		c.logf("  Actual request no headers added: method == %s", r.Method)
 		return
 	}
@@ -321,7 +321,7 @@ func (c *Cors) handleActualRequest(w http.ResponseWriter, r *http.Request) {
 
 		return
 	}
-	if c.allowedOriginsAll && !c.allowCredentials {
+	if c.allowedOriginsAll {
 		headers.Set("Access-Control-Allow-Origin", "*")
 	} else {
 		headers.Set("Access-Control-Allow-Origin", origin)
@@ -373,7 +373,7 @@ func (c *Cors) isMethodAllowed(method string) bool {
 		return false
 	}
 	method = strings.ToUpper(method)
-	if method == "OPTIONS" {
+	if method == http.MethodOptions {
 		// Always allow preflight requests
 		return true
 	}

vendor/github.com/rs/cors/cors_test.go

@@ -83,7 +83,7 @@ func TestSpec(t *testing.T) {
 			},
 			map[string]string{
 				"Vary": "Origin",
-				"Access-Control-Allow-Origin":      "http://foobar.com",
+				"Access-Control-Allow-Origin":      "*",
 				"Access-Control-Allow-Credentials": "true",
 			},
 		},
@@ -242,6 +242,25 @@ func TestSpec(t *testing.T) {
 				"Access-Control-Allow-Headers": "X-Header-2, X-Header-1",
 			},
 		},
+		{
+			"DefaultAllowedHeaders",
+			Options{
+				AllowedOrigins: []string{"http://foobar.com"},
+				AllowedHeaders: []string{},
+			},
+			"OPTIONS",
+			map[string]string{
+				"Origin":                         "http://foobar.com",
+				"Access-Control-Request-Method":  "GET",
+				"Access-Control-Request-Headers": "X-Requested-With",
+			},
+			map[string]string{
+				"Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
+				"Access-Control-Allow-Origin":  "http://foobar.com",
+				"Access-Control-Allow-Methods": "GET",
+				"Access-Control-Allow-Headers": "X-Requested-With",
+			},
+		},
 		{
 			"AllowedWildcardHeader",
 			Options{
@@ -411,7 +430,7 @@ func TestDefault(t *testing.T) {
 	}
 }
 
-func TestHandlePreflightInvlaidOriginAbortion(t *testing.T) {
+func TestHandlePreflightInvalidOriginAbortion(t *testing.T) {
 	s := New(Options{
 		AllowedOrigins: []string{"http://foo.com"},
 	})
@@ -451,7 +470,7 @@ func TestHandleActualRequestAbortsOptionsMethod(t *testing.T) {
 	assertHeaders(t, res.Header(), map[string]string{})
 }
 
-func TestHandleActualRequestInvlaidOriginAbortion(t *testing.T) {
+func TestHandleActualRequestInvalidOriginAbortion(t *testing.T) {
 	s := New(Options{
 		AllowedOrigins: []string{"http://foo.com"},
 	})
@@ -466,7 +485,7 @@ func TestHandleActualRequestInvlaidOriginAbortion(t *testing.T) {
 	})
 }
 
-func TestHandleActualRequestInvlaidMethodAbortion(t *testing.T) {
+func TestHandleActualRequestInvalidMethodAbortion(t *testing.T) {
 	s := New(Options{
 		AllowedMethods:   []string{"POST"},
 		AllowCredentials: true,

vendor/github.com/rs/cors/examples/buffalo/server.go

@@ -0,0 +1,36 @@
+package main
+
+import (
+	"log"
+
+	"github.com/gobuffalo/buffalo"
+	"github.com/gobuffalo/buffalo/render"
+	"github.com/rs/cors"
+)
+
+var r *render.Engine
+
+func init() {
+	r = render.New(render.Options{})
+}
+
+func main() {
+	app := App()
+	if err := app.Serve(); err != nil {
+		log.Fatal(err)
+	}
+}
+
+func App() *buffalo.App {
+	app := buffalo.New(buffalo.Options{
+		PreWares: []buffalo.PreWare{cors.Default().Handler},
+	})
+
+	app.GET("/", HomeHandler)
+
+	return app
+}
+
+func HomeHandler(c buffalo.Context) error {
+	return c.Render(200, r.JSON(map[string]string{"message": "Welcome to Buffalo!"}))
+}

vendor/github.com/rs/cors/examples/gin/server.go

@@ -0,0 +1,19 @@
+package main
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	cors "github.com/rs/cors/wrapper/gin"
+)
+
+func main() {
+	router := gin.Default()
+
+	router.Use(cors.Default())
+	router.GET("/", func(context *gin.Context) {
+		context.JSON(http.StatusOK, gin.H{"hello": "world"})
+	})
+
+	router.Run(":8080")
+}

vendor/github.com/rs/cors/go.mod

@@ -0,0 +1 @@
+module github.com/rs/cors

vendor/github.com/rs/cors/wrapper/gin/gin.go

@@ -0,0 +1,50 @@
+// Package cors/wrapper/gin provides gin.HandlerFunc to handle CORS related
+// requests as a wrapper of github.com/rs/cors handler.
+package gin
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/rs/cors"
+)
+
+// Options is a configuration container to setup the CORS middleware.
+type Options = cors.Options
+
+// corsWrapper is a wrapper of cors.Cors handler which preserves information
+// about configured 'optionPassthrough' option.
+type corsWrapper struct {
+	*cors.Cors
+	optionPassthrough bool
+}
+
+// build transforms wrapped cors.Cors handler into Gin middleware.
+func (c corsWrapper) build() gin.HandlerFunc {
+	return func(ctx *gin.Context) {
+		c.HandlerFunc(ctx.Writer, ctx.Request)
+		if !c.optionPassthrough &&
+			ctx.Request.Method == http.MethodOptions &&
+			ctx.GetHeader("Access-Control-Request-Method") != "" {
+			// Abort processing next Gin middlewares.
+			ctx.AbortWithStatus(http.StatusOK)
+		}
+	}
+}
+
+// AllowAll creates a new CORS Gin middleware with permissive configuration
+// allowing all origins with all standard methods with any header and
+// credentials.
+func AllowAll() gin.HandlerFunc {
+	return corsWrapper{Cors: cors.AllowAll()}.build()
+}
+
+// Default creates a new CORS Gin middleware with default options.
+func Default() gin.HandlerFunc {
+	return corsWrapper{Cors: cors.Default()}.build()
+}
+
+// New creates a new CORS Gin middleware with the provided options.
+func New(options Options) gin.HandlerFunc {
+	return corsWrapper{cors.New(options), options.OptionsPassthrough}.build()
+}

vendor/github.com/rs/cors/wrapper/gin/gin_test.go

@@ -0,0 +1,76 @@
+package gin
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/rs/cors"
+)
+
+func init() {
+	gin.SetMode(gin.ReleaseMode)
+}
+
+func TestAllowAllNotNil(t *testing.T) {
+	handler := AllowAll()
+	if handler == nil {
+		t.Error("Should not return nil Gin handler")
+	}
+}
+
+func TestDefaultNotNil(t *testing.T) {
+	handler := Default()
+	if handler == nil {
+		t.Error("Should not return nil Gin handler")
+	}
+}
+
+func TestNewNotNil(t *testing.T) {
+	handler := New(Options{})
+	if handler == nil {
+		t.Error("Should not return nil Gin handler")
+	}
+}
+
+func TestCorsWrapper_buildAbortsWhenPreflight(t *testing.T) {
+	res := httptest.NewRecorder()
+	ctx, _ := gin.CreateTestContext(res)
+	ctx.Request, _ = http.NewRequest("OPTIONS", "http://example.com/foo", nil)
+	ctx.Request.Header.Add("Origin", "http://example.com/")
+	ctx.Request.Header.Add("Access-Control-Request-Method", "POST")
+	ctx.Status(http.StatusAccepted)
+	res.Code = http.StatusAccepted
+
+	handler := corsWrapper{Cors: cors.New(Options{
+		// Intentionally left blank.
+	})}.build()
+
+	handler(ctx)
+
+	if !ctx.IsAborted() {
+		t.Error("Should abort on preflight requests")
+	}
+	if res.Code != http.StatusOK {
+		t.Error("Should abort with 200 OK status")
+	}
+}
+
+func TestCorsWrapper_buildNotAbortsWhenPassthrough(t *testing.T) {
+	res := httptest.NewRecorder()
+	ctx, _ := gin.CreateTestContext(res)
+	ctx.Request, _ = http.NewRequest("OPTIONS", "http://example.com/foo", nil)
+	ctx.Request.Header.Add("Origin", "http://example.com/")
+	ctx.Request.Header.Add("Access-Control-Request-Method", "POST")
+
+	handler := corsWrapper{cors.New(Options{
+		OptionsPassthrough: true,
+	}), true}.build()
+
+	handler(ctx)
+
+	if ctx.IsAborted() {
+		t.Error("Should not abort when OPTIONS passthrough enabled")
+	}
+}