Harden session migration helpers

Author: ReneWerner87

cmd/internal/migrations/v3/ast_helpers.go

@@ -9,14 +9,14 @@ import (
 )
 
 // parseGoFile parses Go source content into an AST. It returns the parsed file
-// and token.FileSet or an error if the content cannot be parsed.
-func parseGoFile(content string) (*ast.File, *token.FileSet, error) {
+// or an error if the content cannot be parsed.
+func parseGoFile(content string) (*ast.File, error) {
 	fset := token.NewFileSet()
 	file, err := parser.ParseFile(fset, "", content, parser.ParseComments)
 	if err != nil {
-		return nil, nil, fmt.Errorf("parse Go file: %w", err)
+		return nil, fmt.Errorf("parse Go file: %w", err)
 	}
-	return file, fset, nil
+	return file, nil
 }
 
 // collectImportAliases finds all import aliases for the given import path within
@@ -35,6 +35,10 @@ func collectImportAliases(file *ast.File, importPath string) map[string]struct{}
 		}
 
 		if imp.Name != nil {
+			if imp.Name.Name == "_" || imp.Name.Name == "." {
+				continue
+			}
+
 			aliases[imp.Name.Name] = struct{}{}
 			continue
 		}
@@ -53,7 +57,7 @@ func collectAssignedCallIdents(file *ast.File, predicate func(*ast.CallExpr) boo
 
 	ast.Inspect(file, func(n ast.Node) bool {
 		assign, ok := n.(*ast.AssignStmt)
-		if !ok || len(assign.Lhs) != len(assign.Rhs) {
+		if !ok {
 			return true
 		}
 

cmd/internal/migrations/v3/ast_helpers_test.go

@@ -0,0 +1,97 @@
+package v3
+
+import (
+	"go/ast"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_parseGoFile_InvalidContent(t *testing.T) {
+	t.Parallel()
+
+	_, err := parseGoFile("package main\n func")
+	assert.Error(t, err)
+}
+
+func Test_collectImportAliases(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct { //nolint:govet // fieldalignment warning is not relevant for test data shapes
+		content    string
+		importPath string
+		expected   map[string]struct{}
+	}{
+		"default alias": {
+			importPath: "github.com/gofiber/fiber/v3/middleware/session",
+			content:    "package main\nimport \"github.com/gofiber/fiber/v3/middleware/session\"\n",
+			expected:   map[string]struct{}{"session": {}},
+		},
+		"explicit alias": {
+			importPath: "github.com/gofiber/fiber/v3/middleware/session",
+			content:    "package main\nimport sess \"github.com/gofiber/fiber/v3/middleware/session\"\n",
+			expected:   map[string]struct{}{"sess": {}},
+		},
+		"blank import ignored": {
+			importPath: "github.com/gofiber/fiber/v3/middleware/session",
+			content:    "package main\nimport _ \"github.com/gofiber/fiber/v3/middleware/session\"\n",
+			expected:   map[string]struct{}{},
+		},
+		"dot import ignored": {
+			importPath: "github.com/gofiber/fiber/v3/middleware/session",
+			content:    "package main\nimport . \"github.com/gofiber/fiber/v3/middleware/session\"\n",
+			expected:   map[string]struct{}{},
+		},
+		"unrelated import": {
+			importPath: "github.com/gofiber/fiber/v3/middleware/session",
+			content:    "package main\nimport \"github.com/example/other\"\n",
+			expected:   map[string]struct{}{},
+		},
+	}
+
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			file, err := parseGoFile(tt.content)
+			require.NoError(t, err)
+
+			aliases := collectImportAliases(file, tt.importPath)
+			assert.Equal(t, tt.expected, aliases)
+		})
+	}
+}
+
+func Test_collectAssignedCallIdents(t *testing.T) {
+	t.Parallel()
+
+	content := `package main
+
+func target() (int, error) { return 0, nil }
+func other() int { return 1 }
+
+func main() {
+    primary, secondary := target()
+    single := target()
+    _, ignored := target()
+    value, err := other()
+    field.Name = target()
+}
+`
+
+	file, err := parseGoFile(content)
+	require.NoError(t, err)
+
+	matches := collectAssignedCallIdents(file, func(call *ast.CallExpr) bool {
+		if ident, ok := call.Fun.(*ast.Ident); ok {
+			return ident.Name == "target"
+		}
+		return false
+	})
+
+	assert.Contains(t, matches, "primary")
+	assert.Contains(t, matches, "single")
+	assert.NotContains(t, matches, "value")
+	assert.NotContains(t, matches, "ignored")
+}

cmd/internal/migrations/v3/session_release.go

@@ -28,7 +28,7 @@ func MigrateSessionRelease(cmd *cobra.Command, cwd string, _, _ *semver.Version)
 	reStoreGet := regexp.MustCompile(`(?m)^(\s*)(\w+),\s*(\w+)\s*:=\s*(\w+)\.(Get(?:ByID)?)\(`)
 
 	changed, err := internal.ChangeFileContent(cwd, func(content string) string {
-		file, _, err := parseGoFile(content)
+		file, err := parseGoFile(content)
 		if err != nil {
 			return content
 		}
@@ -53,7 +53,7 @@ func MigrateSessionRelease(cmd *cobra.Command, cwd string, _, _ *semver.Version)
 				return false
 			}
 
-			return sel.Sel.Name == "New" || strings.HasPrefix(sel.Sel.Name, "NewStore")
+			return sel.Sel.Name == "New"
 		})
 
 		if len(storeVars) == 0 {

cmd/internal/migrations/v3/session_release_test.go

@@ -26,7 +26,7 @@ import (
 )
 
 func handler(c fiber.Ctx) error {
-    store := session.NewStore()
+    store := session.New()
     sess, err := store.Get(c)
     if err != nil {
         return err
@@ -66,7 +66,7 @@ import (
 )
 
 func handler(c fiber.Ctx) error {
-    store := session.NewStore()
+    store := session.New()
     sess, err := store.Get(c)
     if err != nil {
         return err
@@ -110,7 +110,7 @@ import (
 )
 
 func backgroundTask(sessionID string) {
-    store := session.NewStore()
+    store := session.New()
     sess, err := store.GetByID(context.Background(), sessionID)
     if err != nil {
         return
@@ -150,7 +150,7 @@ import (
 )
 
 func handler(c fiber.Ctx) error {
-    store := session.NewStore()
+    store := session.New()
     sess, err := store.Get(c)
     if err != nil {
         c.Status(500)
@@ -233,7 +233,7 @@ import (
 )
 
 func handler(c fiber.Ctx) error {
-    store := alias.NewStore()
+    store := alias.New()
     session, err := store.Get(c)
     if err != nil {
         return err