pkg/web: avoid shared middleware slice (#58458)

pkg/web/macaron.go

@@ -144,8 +144,14 @@ func mwFromHandler(handler Handler) Middleware {
 }
 
 func (m *Macaron) createContext(rw http.ResponseWriter, req *http.Request) *Context {
+	// NOTE: we have to explicitly copy the middleware chain here to avoid
+	// passing a shared slice to the *Context, which leads to racy behavior in
+	// case of later appends
+	mws := make([]Middleware, len(m.mws))
+	copy(mws, m.mws)
+
 	c := &Context{
-		mws:  m.mws,
+		mws:  mws,
 		Resp: NewResponseWriter(req.Method, rw),
 	}