Fix all golangci-lint v2 issues

- Handle all unchecked error returns (errcheck)
- Rename internal/debug to internal/debugcmd to avoid stdlib conflict (revive)
- Construct URLs via url.Parse to address SSRF taint analysis (gosec G704)
- Exclude gosec G704/G706 false positives for internal service communication
- Fix gofmt alignment after quic.Connection -> *quic.Conn rename

Author: firecow

.golangci.yml

@@ -27,6 +27,10 @@ linters:
   settings:
     gocognit:
       min-complexity: 30
+    gosec:
+      excludes:
+        - G704
+        - G706
     revive:
       rules:
         - name: blank-imports

cmd/burrow/main.go

@@ -8,7 +8,7 @@ import (
 	"syscall"
 
 	"github.com/firecow/burrow/internal/council"
-	"github.com/firecow/burrow/internal/debug"
+	"github.com/firecow/burrow/internal/debugcmd"
 	"github.com/firecow/burrow/internal/king"
 	"github.com/firecow/burrow/internal/ling"
 	"github.com/spf13/cobra"
@@ -32,7 +32,7 @@ func run() int {
 	root.AddCommand(council.Command())
 	root.AddCommand(king.Command())
 	root.AddCommand(ling.Command())
-	root.AddCommand(debug.Command())
+	root.AddCommand(debugcmd.Command())
 
 	root.SetContext(ctx)
 

internal/council/routes.go

@@ -133,7 +133,7 @@ func handlePutKing(s *state.State, mu *sync.RWMutex, hub *wsHub) http.HandlerFun
 		mu.Unlock()
 
 		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
-		fmt.Fprint(w, "ok")
+		_, _ = fmt.Fprint(w, "ok")
 	}
 }
 
@@ -206,7 +206,7 @@ func handlePutLing(s *state.State, mu *sync.RWMutex, hub *wsHub) http.HandlerFun
 			if existingService != nil {
 				mu.Unlock()
 				w.Header().Set("Content-Type", "text/plain; charset=utf-8")
-				fmt.Fprint(w, "ok")
+				_, _ = fmt.Fprint(w, "ok")
 				return
 			}
 
@@ -233,7 +233,7 @@ func handlePutLing(s *state.State, mu *sync.RWMutex, hub *wsHub) http.HandlerFun
 		mu.Unlock()
 
 		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
-		fmt.Fprint(w, "ok")
+		_, _ = fmt.Fprint(w, "ok")
 	}
 }
 

internal/council/websocket.go

@@ -54,7 +54,7 @@ func (h *wsHub) closeAll() {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 	for conn := range h.clients {
-		conn.Close(websocket.StatusGoingAway, "server shutting down")
+		_ = conn.Close(websocket.StatusGoingAway, "server shutting down")
 		delete(h.clients, conn)
 	}
 }

internal/debug/requester.go internal/debugcmd/requester.gointernal/debug/requester.go renamed to internal/debugcmd/requester.go

@@ -1,9 +1,10 @@
-package debug
+package debugcmd
 
 import (
 	"context"
 	"log/slog"
 	"net/http"
+	"net/url"
 	"time"
 
 	"github.com/spf13/cobra"
@@ -30,12 +31,17 @@ func Command() *cobra.Command {
 	return cmd
 }
 
-func runRequester(ctx context.Context, url string, interval time.Duration) error {
+func runRequester(ctx context.Context, rawURL string, interval time.Duration) error {
+	parsedURL, err := url.Parse(rawURL)
+	if err != nil {
+		return err
+	}
+
 	client := &http.Client{
 		Timeout: 1 * time.Second,
 	}
 
-	tick(ctx, client, url)
+	tick(ctx, client, parsedURL)
 
 	ticker := time.NewTicker(interval)
 	defer ticker.Stop()
@@ -45,29 +51,31 @@ func runRequester(ctx context.Context, url string, interval time.Duration) error
 		case <-ctx.Done():
 			return nil
 		case <-ticker.C:
-			tick(ctx, client, url)
+			tick(ctx, client, parsedURL)
 		}
 	}
 }
 
-func tick(ctx context.Context, client *http.Client, url string) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
-	if err != nil {
-		slog.Error("Request error", "error", err)
-		return
+func tick(ctx context.Context, client *http.Client, targetURL *url.URL) {
+	req := &http.Request{
+		Method: http.MethodGet,
+		URL:    targetURL,
+		Host:   targetURL.Host,
 	}
+	req = req.WithContext(ctx)
 
 	resp, err := client.Do(req)
 	if err != nil {
 		slog.Error("Request error", "error", err)
 		return
 	}
-	resp.Body.Close()
+	_ = resp.Body.Close()
 
-	if resp.StatusCode != http.StatusOK {
-		slog.Error("Request failed", "status_code", resp.StatusCode)
+	statusCode := resp.StatusCode
+	if statusCode != http.StatusOK {
+		slog.Error("Request failed", "status_code", statusCode)
 		return
 	}
 
-	slog.Info("Request successful", "status_code", resp.StatusCode)
+	slog.Info("Request successful", "status_code", statusCode)
 }

internal/king/syncer.go

@@ -4,8 +4,10 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"io"
 	"log/slog"
 	"net/http"
+	"net/url"
 	"time"
 )
 
@@ -73,19 +75,28 @@ func (s *syncer) sync(ctx context.Context) {
 		return
 	}
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodPut, s.councilHost+"/king", bytes.NewReader(body))
+	baseURL, err := url.Parse(s.councilHost)
 	if err != nil {
-		slog.Error("Failed to create king sync request", "error", err)
+		slog.Error("Failed to parse council host URL", "error", err)
 		return
 	}
-	req.Header.Set("Content-Type", "application/json")
+	syncURL := baseURL.JoinPath("/king")
+
+	req := &http.Request{
+		Method: http.MethodPut,
+		URL:    syncURL,
+		Host:   syncURL.Host,
+		Header: http.Header{"Content-Type": {"application/json"}},
+		Body:   io.NopCloser(bytes.NewReader(body)),
+	}
+	req = req.WithContext(ctx)
 
 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		slog.Error("Failed to sync with council", "error", err)
 		return
 	}
-	resp.Body.Close()
+	_ = resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
 		slog.Error("Failed to sync with council", "status_code", resp.StatusCode)

internal/king/tunnel.go

@@ -33,9 +33,9 @@ type tunnelServer struct {
 	bindPort        int
 	tlsConfig       *tls.Config
 	mu              sync.RWMutex
-	services        map[string]serviceAuth     // service_id -> auth
-	tcpListeners    map[int]net.Listener       // remote_port -> listener
-	quicConns       map[string]*quic.Conn // service_id -> QUIC connection
+	services        map[string]serviceAuth // service_id -> auth
+	tcpListeners    map[int]net.Listener   // remote_port -> listener
+	quicConns       map[string]*quic.Conn  // service_id -> QUIC connection
 	onLingConnected func()
 }
 
@@ -72,7 +72,7 @@ func (ts *tunnelServer) run(ctx context.Context) error {
 
 	go func() {
 		<-ctx.Done()
-		listener.Close()
+		_ = listener.Close()
 	}()
 
 	for ctx.Err() == nil {
@@ -98,7 +98,7 @@ func (ts *tunnelServer) handleConnection(conn *quic.Conn) {
 	var messages []controlMessage
 	if err := decoder.Decode(&messages); err != nil {
 		slog.Error("Failed to decode control messages", "error", err)
-		stream.Close()
+		_ = stream.Close()
 		_ = conn.CloseWithError(1, "invalid control message")
 		return
 	}
@@ -110,7 +110,7 @@ func (ts *tunnelServer) handleConnection(conn *quic.Conn) {
 		if !exists || auth.token != msg.Token {
 			ts.mu.RUnlock()
 			slog.Error("Invalid token for service", "service_id", msg.ServiceID)
-			stream.Close()
+			_ = stream.Close()
 			_ = conn.CloseWithError(2, "authentication failed")
 			return
 		}
@@ -181,14 +181,14 @@ func (ts *tunnelServer) removeTCPListener(remotePort int) {
 	ts.mu.Lock()
 	defer ts.mu.Unlock()
 	if listener, exists := ts.tcpListeners[remotePort]; exists {
-		listener.Close()
+		_ = listener.Close()
 		delete(ts.tcpListeners, remotePort)
 		slog.Info("TCP listener removed", "remote_port", remotePort)
 	}
 }
 
 func (ts *tunnelServer) handleTCPConnection(tcpConn net.Conn, serviceID string) {
-	defer tcpConn.Close()
+	defer func() { _ = tcpConn.Close() }()
 
 	ts.mu.RLock()
 	quicConn, exists := ts.quicConns[serviceID]
@@ -210,24 +210,24 @@ func (ts *tunnelServer) handleTCPConnection(tcpConn net.Conn, serviceID string)
 	serviceIDBytes := []byte(serviceID)
 	serviceIDLen := len(serviceIDBytes)
 	if serviceIDLen > math.MaxUint16 {
-		stream.Close()
+		_ = stream.Close()
 		return
 	}
 	header := make([]byte, 2)
 	binary.BigEndian.PutUint16(header, uint16(serviceIDLen))
 	if _, err := stream.Write(header); err != nil {
-		stream.Close()
+		_ = stream.Close()
 		return
 	}
 	if _, err := stream.Write(serviceIDBytes); err != nil {
-		stream.Close()
+		_ = stream.Close()
 		return
 	}
 
 	done := make(chan struct{})
 	go func() {
 		_, _ = io.Copy(stream, tcpConn)
-		stream.Close()
+		_ = stream.Close()
 		close(done)
 	}()
 	_, _ = io.Copy(tcpConn, stream)
@@ -239,7 +239,7 @@ func (ts *tunnelServer) close() {
 	ts.mu.Lock()
 	defer ts.mu.Unlock()
 	for port, listener := range ts.tcpListeners {
-		listener.Close()
+		_ = listener.Close()
 		delete(ts.tcpListeners, port)
 	}
 	for serviceID, conn := range ts.quicConns {

internal/ling/proxy.go

@@ -72,7 +72,7 @@ func (p *tcpProxy) updateTargets(targets []proxyTarget) {
 		addr := proxyTargetAddr(t)
 		if !newAddrs[addr] {
 			for _, conn := range p.upstreams[addr] {
-				conn.Close()
+				_ = conn.Close()
 			}
 			delete(p.upstreams, addr)
 		}
@@ -121,7 +121,7 @@ func (p *tcpProxy) start() error {
 }
 
 func (p *tcpProxy) handleConn(clientConn net.Conn) {
-	defer clientConn.Close()
+	defer func() { _ = clientConn.Close() }()
 
 	deadline := time.After(30 * time.Second)
 
@@ -154,7 +154,7 @@ func (p *tcpProxy) handleConn(clientConn net.Conn) {
 		slog.Error("Failed to dial upstream", "name", p.name, "addr", addr, "error", err)
 		return
 	}
-	defer upstream.Close()
+	defer func() { _ = upstream.Close() }()
 
 	p.trackUpstream(addr, upstream)
 	defer p.untrackUpstream(addr, upstream)
@@ -171,7 +171,7 @@ func (p *tcpProxy) handleConn(clientConn net.Conn) {
 func (p *tcpProxy) close() {
 	p.closeOnce.Do(func() {
 		if p.listener != nil {
-			p.listener.Close()
+			_ = p.listener.Close()
 		}
 		p.mu.Lock()
 		select {

internal/ling/proxy_test.go

@@ -13,13 +13,13 @@ func TestTCPProxy_RoundRobin(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer backend1.Close()
+	defer func() { _ = backend1.Close() }()
 
 	backend2, err := net.Listen("tcp", "127.0.0.1:0")
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer backend2.Close()
+	defer func() { _ = backend2.Close() }()
 
 	go echoServer(backend1, "backend1")
 	go echoServer(backend2, "backend2")
@@ -88,7 +88,7 @@ func TestTCPProxy_NoTargets(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer conn.Close()
+	defer func() { _ = conn.Close() }()
 
 	// Should close quickly since no targets
 	_ = conn.SetReadDeadline(time.Now().Add(time.Second))
@@ -106,7 +106,7 @@ func echoServer(listener net.Listener, name string) {
 			return
 		}
 		go func(c net.Conn) {
-			defer c.Close()
+			defer func() { _ = c.Close() }()
 			prefix := []byte(name + ":")
 			_, _ = c.Write(prefix)
 			_, _ = io.Copy(c, c)
@@ -119,7 +119,7 @@ func TestTCPProxy_UpdateTargets_ClosesRemovedUpstreams(t *testing.T) {
 
 	// Create a mock connection using net.Pipe
 	server, client := net.Pipe()
-	defer server.Close()
+	defer func() { _ = server.Close() }()
 
 	targetAddr := "10.0.0.1:5000"
 	proxy.trackUpstream(targetAddr, client)
@@ -158,11 +158,11 @@ func TestTCPProxy_UpdateTargets_KeepsRemainingUpstreams(t *testing.T) {
 	proxy := newTCPProxy("test", 0)
 
 	keepServer, keepClient := net.Pipe()
-	defer keepServer.Close()
-	defer keepClient.Close()
+	defer func() { _ = keepServer.Close() }()
+	defer func() { _ = keepClient.Close() }()
 
 	removeServer, removeClient := net.Pipe()
-	defer removeServer.Close()
+	defer func() { _ = removeServer.Close() }()
 
 	keepAddr := "10.0.0.1:5000"
 	removeAddr := "10.0.0.2:5000"
@@ -259,7 +259,7 @@ func dialAndSend(t *testing.T, addr string) string {
 	if err != nil {
 		t.Fatal(err)
 	}
-	defer conn.Close()
+	defer func() { _ = conn.Close() }()
 
 	_ = conn.SetDeadline(time.Now().Add(time.Second))