Skip to content

Commit dd8ea4e

Browse files
sonupreetamsonupreetam
committed
chore: update go.mod to fix vuln
Signed-off-by: Sonu Preetam <spreetam@redhat.com>
1 parent 7c5d33c commit dd8ea4e

12 files changed

Lines changed: 135 additions & 80 deletions

File tree

‎cmd/sync-content/cleanup_test.go‎

Lines changed: 21 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,12 @@ func TestCleanOrphanedFiles(t *testing.T) {
1515
otherFile := filepath.Join(dir, "content", "docs", "projects", "complyscribe", "_index.md")
1616

1717
for _, f := range []string{staleFile, keptFile, otherFile} {
18-
os.MkdirAll(filepath.Dir(f), 0o755)
19-
os.WriteFile(f, []byte("test"), 0o644)
18+
if err := os.MkdirAll(filepath.Dir(f), 0o755); err != nil {
19+
t.Fatalf("MkdirAll: %v", err)
20+
}
21+
if err := os.WriteFile(f, []byte("test"), 0o600); err != nil {
22+
t.Fatalf("WriteFile: %v", err)
23+
}
2024
}
2125

2226
oldManifest := map[string]bool{
@@ -51,8 +55,12 @@ func TestCleanOrphanedFiles_PrunesEmptyDirs(t *testing.T) {
5155

5256
staleDir := filepath.Join(dir, "content", "docs", "projects", "removed-repo")
5357
staleFile := filepath.Join(staleDir, "_index.md")
54-
os.MkdirAll(staleDir, 0o755)
55-
os.WriteFile(staleFile, []byte("test"), 0o644)
58+
if err := os.MkdirAll(staleDir, 0o755); err != nil {
59+
t.Fatalf("MkdirAll: %v", err)
60+
}
61+
if err := os.WriteFile(staleFile, []byte("test"), 0o600); err != nil {
62+
t.Fatalf("WriteFile: %v", err)
63+
}
5664

5765
oldManifest := map[string]bool{
5866
"content/docs/projects/removed-repo/_index.md": true,
@@ -73,7 +81,9 @@ func TestCleanOrphanedFiles_TraversalBlocked(t *testing.T) {
7381

7482
outsideDir := t.TempDir()
7583
outsideFile := filepath.Join(outsideDir, "should-survive.txt")
76-
os.WriteFile(outsideFile, []byte("protected"), 0o644)
84+
if err := os.WriteFile(outsideFile, []byte("protected"), 0o600); err != nil {
85+
t.Fatalf("WriteFile: %v", err)
86+
}
7787

7888
relTraversal, err := filepath.Rel(dir, outsideFile)
7989
if err != nil {
@@ -98,8 +108,12 @@ func TestCleanOrphanedFiles_LegitimateRemoval(t *testing.T) {
98108
dir := t.TempDir()
99109

100110
legitFile := filepath.Join(dir, "content", "docs", "projects", "old-repo", "_index.md")
101-
os.MkdirAll(filepath.Dir(legitFile), 0o755)
102-
os.WriteFile(legitFile, []byte("stale"), 0o644)
111+
if err := os.MkdirAll(filepath.Dir(legitFile), 0o755); err != nil {
112+
t.Fatalf("MkdirAll: %v", err)
113+
}
114+
if err := os.WriteFile(legitFile, []byte("stale"), 0o600); err != nil {
115+
t.Fatalf("WriteFile: %v", err)
116+
}
103117

104118
oldManifest := map[string]bool{
105119
"content/docs/projects/old-repo/_index.md": true,

‎cmd/sync-content/config_test.go‎

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,17 @@ func TestLoadConfig(t *testing.T) {
1212
t.Run("valid config", func(t *testing.T) {
1313
dir := t.TempDir()
1414
path := filepath.Join(dir, "sync-config.yaml")
15-
os.WriteFile(path, []byte(`
15+
if err := os.WriteFile(path, []byte(`
1616
defaults:
1717
branch: main
1818
sources:
1919
- repo: org/repo1
2020
files:
2121
- src: README.md
2222
dest: content/docs/projects/repo1/_index.md
23-
`), 0o644)
23+
`), 0o600); err != nil {
24+
t.Fatalf("WriteFile: %v", err)
25+
}
2426

2527
cfg, err := loadConfig(path)
2628
if err != nil {
@@ -43,13 +45,15 @@ sources:
4345
t.Run("default branch applied", func(t *testing.T) {
4446
dir := t.TempDir()
4547
path := filepath.Join(dir, "cfg.yaml")
46-
os.WriteFile(path, []byte(`
48+
if err := os.WriteFile(path, []byte(`
4749
sources:
4850
- repo: org/repo1
4951
files:
5052
- src: README.md
5153
dest: out/README.md
52-
`), 0o644)
54+
`), 0o600); err != nil {
55+
t.Fatalf("WriteFile: %v", err)
56+
}
5357

5458
cfg, err := loadConfig(path)
5559
if err != nil {
@@ -63,7 +67,9 @@ sources:
6367
t.Run("malformed YAML", func(t *testing.T) {
6468
dir := t.TempDir()
6569
path := filepath.Join(dir, "bad.yaml")
66-
os.WriteFile(path, []byte(`{{{not yaml`), 0o644)
70+
if err := os.WriteFile(path, []byte(`{{{not yaml`), 0o600); err != nil {
71+
t.Fatalf("WriteFile: %v", err)
72+
}
6773

6874
_, err := loadConfig(path)
6975
if err == nil {
@@ -81,12 +87,14 @@ sources:
8187
t.Run("missing repo field", func(t *testing.T) {
8288
dir := t.TempDir()
8389
path := filepath.Join(dir, "cfg.yaml")
84-
os.WriteFile(path, []byte(`
90+
if err := os.WriteFile(path, []byte(`
8591
sources:
8692
- files:
8793
- src: README.md
8894
dest: out/README.md
89-
`), 0o644)
95+
`), 0o600); err != nil {
96+
t.Fatalf("WriteFile: %v", err)
97+
}
9098

9199
_, err := loadConfig(path)
92100
if err == nil {
@@ -100,12 +108,14 @@ sources:
100108
t.Run("missing src field", func(t *testing.T) {
101109
dir := t.TempDir()
102110
path := filepath.Join(dir, "cfg.yaml")
103-
os.WriteFile(path, []byte(`
111+
if err := os.WriteFile(path, []byte(`
104112
sources:
105113
- repo: org/repo1
106114
files:
107115
- dest: out/README.md
108-
`), 0o644)
116+
`), 0o600); err != nil {
117+
t.Fatalf("WriteFile: %v", err)
118+
}
109119

110120
_, err := loadConfig(path)
111121
if err == nil {

‎cmd/sync-content/github.go‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -89,13 +89,13 @@ func (c *apiClient) getJSON(ctx context.Context, url string, dst any) error {
8989
if resp.StatusCode == http.StatusOK {
9090
limited := io.LimitReader(resp.Body, maxResponseBytes)
9191
err = json.NewDecoder(limited).Decode(dst)
92-
io.Copy(io.Discard, resp.Body)
93-
resp.Body.Close()
92+
_, _ = io.Copy(io.Discard, resp.Body)
93+
_ = resp.Body.Close()
9494
return err
9595
}
9696

9797
body, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
98-
resp.Body.Close()
98+
_ = resp.Body.Close()
9999
lastErr = fmt.Errorf("GET %s: %d %s", url, resp.StatusCode, body)
100100

101101
if !isRateLimited(resp) || attempt == maxRetries {
@@ -140,7 +140,14 @@ func retryWait(resp *http.Response, attempt int) time.Duration {
140140
}
141141
}
142142
}
143-
return time.Duration(1<<uint(attempt)) * time.Second
143+
shift := attempt
144+
if shift < 0 {
145+
shift = 0
146+
}
147+
if shift > 5 {
148+
shift = 5
149+
}
150+
return time.Duration(1<<shift) * time.Second
144151
}
145152

146153
// appendRef appends a ?ref= query parameter to a URL when ref is non-empty,

‎cmd/sync-content/github_test.go‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,15 +14,15 @@ func TestListDirMD(t *testing.T) {
1414
mux := http.NewServeMux()
1515

1616
mux.HandleFunc("/repos/org/repo/contents/docs", func(w http.ResponseWriter, r *http.Request) {
17-
json.NewEncoder(w).Encode([]DirEntry{
17+
_ = json.NewEncoder(w).Encode([]DirEntry{
1818
{Name: "guide.md", Path: "docs/guide.md", Type: "file"},
1919
{Name: "image.png", Path: "docs/image.png", Type: "file"},
2020
{Name: "sub", Path: "docs/sub", Type: "dir"},
2121
})
2222
})
2323

2424
mux.HandleFunc("/repos/org/repo/contents/docs/sub", func(w http.ResponseWriter, r *http.Request) {
25-
json.NewEncoder(w).Encode([]DirEntry{
25+
_ = json.NewEncoder(w).Encode([]DirEntry{
2626
{Name: "nested.md", Path: "docs/sub/nested.md", Type: "file"},
2727
{Name: "data.json", Path: "docs/sub/data.json", Type: "file"},
2828
})
@@ -64,7 +64,7 @@ func TestListDirMD_DepthLimit(t *testing.T) {
6464
mux := http.NewServeMux()
6565
mux.HandleFunc("/repos/org/repo/contents/", func(w http.ResponseWriter, r *http.Request) {
6666
callCount++
67-
json.NewEncoder(w).Encode([]DirEntry{
67+
_ = json.NewEncoder(w).Encode([]DirEntry{
6868
{Name: "file.md", Path: r.URL.Path[len("/repos/org/repo/contents/"):] + "/file.md", Type: "file"},
6969
{Name: "deeper", Path: r.URL.Path[len("/repos/org/repo/contents/"):] + "/deeper", Type: "dir"},
7070
})
@@ -134,7 +134,7 @@ func TestGetREADME_WithRef(t *testing.T) {
134134
mux := http.NewServeMux()
135135
mux.HandleFunc("/repos/org/repo/readme", func(w http.ResponseWriter, r *http.Request) {
136136
receivedRef = r.URL.Query().Get("ref")
137-
json.NewEncoder(w).Encode(FileResponse{
137+
_ = json.NewEncoder(w).Encode(FileResponse{
138138
Content: "VEVTVA==",
139139
Encoding: "base64",
140140
SHA: "sha123",
@@ -171,7 +171,7 @@ func TestListDirMD_WithRef(t *testing.T) {
171171
mux := http.NewServeMux()
172172
mux.HandleFunc("/repos/org/repo/contents/docs", func(w http.ResponseWriter, r *http.Request) {
173173
receivedRef = r.URL.Query().Get("ref")
174-
json.NewEncoder(w).Encode([]DirEntry{
174+
_ = json.NewEncoder(w).Encode([]DirEntry{
175175
{Name: "guide.md", Path: "docs/guide.md", Type: "file"},
176176
})
177177
})
@@ -206,7 +206,7 @@ func TestFetchPeribolosRepos(t *testing.T) {
206206
t.Run("success", func(t *testing.T) {
207207
mux := http.NewServeMux()
208208
mux.HandleFunc("/repos/myorg/.github/contents/peribolos.yaml", func(w http.ResponseWriter, r *http.Request) {
209-
json.NewEncoder(w).Encode(FileResponse{
209+
_ = json.NewEncoder(w).Encode(FileResponse{
210210
Content: b64(peribolosYAML),
211211
Encoding: "base64",
212212
})
@@ -234,7 +234,7 @@ func TestFetchPeribolosRepos(t *testing.T) {
234234
t.Run("missing org in peribolos", func(t *testing.T) {
235235
mux := http.NewServeMux()
236236
mux.HandleFunc("/repos/otherorg/.github/contents/peribolos.yaml", func(w http.ResponseWriter, r *http.Request) {
237-
json.NewEncoder(w).Encode(FileResponse{
237+
_ = json.NewEncoder(w).Encode(FileResponse{
238238
Content: b64(peribolosYAML),
239239
Encoding: "base64",
240240
})
@@ -254,7 +254,7 @@ func TestFetchPeribolosRepos(t *testing.T) {
254254
mux := http.NewServeMux()
255255
mux.HandleFunc("/repos/noorg/.github/contents/peribolos.yaml", func(w http.ResponseWriter, r *http.Request) {
256256
w.WriteHeader(http.StatusNotFound)
257-
w.Write([]byte(`{"message":"Not Found"}`))
257+
_, _ = w.Write([]byte(`{"message":"Not Found"}`))
258258
})
259259

260260
server := httptest.NewServer(mux)
@@ -271,7 +271,7 @@ func TestFetchPeribolosRepos(t *testing.T) {
271271
func TestGetRepoMetadata(t *testing.T) {
272272
mux := http.NewServeMux()
273273
mux.HandleFunc("/repos/org/myrepo", func(w http.ResponseWriter, r *http.Request) {
274-
json.NewEncoder(w).Encode(Repo{
274+
_ = json.NewEncoder(w).Encode(Repo{
275275
Name: "myrepo",
276276
FullName: "org/myrepo",
277277
Description: "A test repo",
@@ -305,7 +305,7 @@ func TestContextCancellationDuringRetry(t *testing.T) {
305305
callCount++
306306
w.Header().Set("Retry-After", "60")
307307
w.WriteHeader(http.StatusTooManyRequests)
308-
w.Write([]byte(`{"message":"rate limited"}`))
308+
_, _ = w.Write([]byte(`{"message":"rate limited"}`))
309309
})
310310
server := httptest.NewServer(mux)
311311
defer server.Close()

‎cmd/sync-content/lock.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ func writeLock(path string, lock *ContentLock) error {
5858
if err != nil {
5959
return fmt.Errorf("marshaling lock: %w", err)
6060
}
61-
return os.WriteFile(path, append(data, '\n'), 0o644)
61+
return os.WriteFile(path, append(data, '\n'), 0o600)
6262
}
6363

6464
// sha returns the approved branch SHA for a repo, or "" if not locked.

‎cmd/sync-content/lock_test.go‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,9 @@ func TestReadLock_MissingFile(t *testing.T) {
5151
func TestReadLock_InvalidJSON(t *testing.T) {
5252
dir := t.TempDir()
5353
path := filepath.Join(dir, "bad.json")
54-
os.WriteFile(path, []byte("not json"), 0o644)
54+
if err := os.WriteFile(path, []byte("not json"), 0o600); err != nil {
55+
t.Fatalf("WriteFile: %v", err)
56+
}
5557

5658
_, err := readLock(path)
5759
if err == nil {
@@ -106,7 +108,9 @@ func TestWriteLock_DeterministicOrder(t *testing.T) {
106108
func TestReadLock_NilReposInitialized(t *testing.T) {
107109
dir := t.TempDir()
108110
path := filepath.Join(dir, "lock.json")
109-
os.WriteFile(path, []byte(`{}`), 0o644)
111+
if err := os.WriteFile(path, []byte(`{}`), 0o600); err != nil {
112+
t.Fatalf("WriteFile: %v", err)
113+
}
110114

111115
lock, err := readLock(path)
112116
if err != nil {

‎cmd/sync-content/manifest.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,5 +131,5 @@ func writeManifest(outputDir string, files []string) error {
131131
if err != nil {
132132
return err
133133
}
134-
return os.WriteFile(filepath.Join(outputDir, manifestFile), append(data, '\n'), 0o644)
134+
return os.WriteFile(filepath.Join(outputDir, manifestFile), append(data, '\n'), 0o600)
135135
}

‎cmd/sync-content/manifest_test.go‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,9 @@ func TestReadFrontmatterParams(t *testing.T) {
4444
t.Run("reads params from generated frontmatter", func(t *testing.T) {
4545
dir := t.TempDir()
4646
path := filepath.Join(dir, "_index.md")
47-
os.WriteFile(path, []byte("---\ntitle: \"test\"\nparams:\n source_sha: \"abc123\"\n readme_sha: \"def456\"\n---\n"), 0o644)
47+
if err := os.WriteFile(path, []byte("---\ntitle: \"test\"\nparams:\n source_sha: \"abc123\"\n readme_sha: \"def456\"\n---\n"), 0o600); err != nil {
48+
t.Fatalf("WriteFile: %v", err)
49+
}
4850

4951
params := readFrontmatterParams(path)
5052
if params == nil {
@@ -61,7 +63,9 @@ func TestReadFrontmatterParams(t *testing.T) {
6163
t.Run("does not match similarly-prefixed keys", func(t *testing.T) {
6264
dir := t.TempDir()
6365
path := filepath.Join(dir, "_index.md")
64-
os.WriteFile(path, []byte("---\ntitle: \"test\"\nparams:\n source_sha_v2: \"wrong\"\n source_sha: \"correct\"\n---\n"), 0o644)
66+
if err := os.WriteFile(path, []byte("---\ntitle: \"test\"\nparams:\n source_sha_v2: \"wrong\"\n source_sha: \"correct\"\n---\n"), 0o600); err != nil {
67+
t.Fatalf("WriteFile: %v", err)
68+
}
6569

6670
params := readFrontmatterParams(path)
6771
if v, _ := params["source_sha"].(string); v != "correct" {
@@ -82,7 +86,9 @@ func TestReadFrontmatterParams(t *testing.T) {
8286
t.Run("no frontmatter returns nil", func(t *testing.T) {
8387
dir := t.TempDir()
8488
path := filepath.Join(dir, "plain.md")
85-
os.WriteFile(path, []byte("# No frontmatter\nBody."), 0o644)
89+
if err := os.WriteFile(path, []byte("# No frontmatter\nBody."), 0o600); err != nil {
90+
t.Fatalf("WriteFile: %v", err)
91+
}
8692

8793
params := readFrontmatterParams(path)
8894
if params != nil {
@@ -93,7 +99,9 @@ func TestReadFrontmatterParams(t *testing.T) {
9399
t.Run("no params section returns nil", func(t *testing.T) {
94100
dir := t.TempDir()
95101
path := filepath.Join(dir, "no-params.md")
96-
os.WriteFile(path, []byte("---\ntitle: test\n---\nBody."), 0o644)
102+
if err := os.WriteFile(path, []byte("---\ntitle: test\n---\nBody."), 0o600); err != nil {
103+
t.Fatalf("WriteFile: %v", err)
104+
}
97105

98106
params := readFrontmatterParams(path)
99107
if params != nil {
@@ -105,10 +113,14 @@ func TestReadFrontmatterParams(t *testing.T) {
105113
func TestReadExistingState_UsesYAMLParsing(t *testing.T) {
106114
dir := t.TempDir()
107115
repoDir := filepath.Join(dir, "content", "docs", "projects", "test-repo")
108-
os.MkdirAll(repoDir, 0o755)
109-
os.WriteFile(filepath.Join(repoDir, "_index.md"), []byte(
116+
if err := os.MkdirAll(repoDir, 0o755); err != nil {
117+
t.Fatalf("MkdirAll: %v", err)
118+
}
119+
if err := os.WriteFile(filepath.Join(repoDir, "_index.md"), []byte(
110120
"---\ntitle: \"test-repo\"\nparams:\n source_sha: \"branch-sha-123\"\n readme_sha: \"readme-sha-456\"\n---\n",
111-
), 0o644)
121+
), 0o600); err != nil {
122+
t.Fatalf("WriteFile: %v", err)
123+
}
112124

113125
state := readExistingState(dir)
114126
if len(state) != 1 {

0 commit comments

Comments
 (0)