Merge pull request #1333 from chaitin/ci-fix-sixth-scan-findings

fix(management,mcp-server): stop the request chain on a failed session

Author: jlongWang

management/tcontrollerd/utils/file.go

@@ -84,16 +84,16 @@ func RenameCopyFromIO(src io.Reader, dstPath string, perm os.FileMode) error {
 	renamed := false
 	defer func() {
 		if !renamed {
-			os.Remove(tmpName)
+			_ = os.Remove(tmpName)
 		}
 	}()
 
 	if err = tmpFile.Chmod(perm); err != nil {
-		tmpFile.Close()
+		_ = tmpFile.Close()
 		return err
 	}
 	if _, err = io.Copy(tmpFile, src); err != nil {
-		tmpFile.Close()
+		_ = tmpFile.Close()
 		return err
 	}
 	if err = tmpFile.Close(); err != nil {
@@ -131,11 +131,8 @@ func CopyFile(srcPath, dstPath string) error {
 	if err != nil {
 		return err
 	}
-	defer func(srcFile *os.File) {
-		err := srcFile.Close()
-		if err != nil {
-
-		}
+	defer func(f *os.File) {
+		_ = f.Close()
 	}(srcFile)
 
 	fileInfo, err := srcFile.Stat()

management/webserver/api/cert.go

@@ -122,15 +122,17 @@ func saveUploadedFile(file *multipart.FileHeader, dstPath string, mode os.FileMo
 	if err != nil {
 		return err
 	}
-	defer src.Close()
+	defer func() {
+		_ = src.Close()
+	}()
 
 	dst, err := os.OpenFile(dstPath, os.O_WRONLY|os.O_CREATE|os.O_EXCL, mode)
 	if err != nil {
 		return err
 	}
 
 	if _, err = io.Copy(dst, src); err != nil {
-		dst.Close()
+		_ = dst.Close()
 		return err
 	}
 

management/webserver/api/website.go

@@ -202,13 +202,15 @@ func GetWebsite(ctx *gin.Context) {
 	var statistics []model.SystemStatistics
 	var websiteIds []string
 	for _, i := range websiteList {
-		websiteIds = append(websiteIds, strconv.Itoa(int(i.ID)))
+		// FormatUint renders the identifier without narrowing it: it is a uint,
+		// and going through int would truncate it on a 32 bit build.
+		websiteIds = append(websiteIds, strconv.FormatUint(uint64(i.ID), 10))
 	}
 	db.Where("created_at >= date_trunc('day',now())").Where("website in (?)", websiteIds).Find(&statistics)
 
 	for i, website := range websiteList {
 		for _, j := range statistics {
-			if strconv.Itoa(int(website.ID)) == j.Website {
+			if strconv.FormatUint(uint64(website.ID), 10) == j.Website {
 				if j.Type == "website-req" {
 					websiteList[i].ReqValue = j.Value
 				} else if j.Type == "website-denied" {

management/webserver/middleware/auth.go

@@ -26,6 +26,11 @@ func AuthRequired(c *gin.Context) {
 
 	if err := session.Save(); err != nil {
 		response.Error(c, response.JSONBody{Err: response.ErrInternalError, Msg: "Error occurred when creating sessions"}, http.StatusInternalServerError)
+		// The request has to stop here. Gin runs the handlers that follow a
+		// middleware from the same loop that called this one, so returning
+		// without Abort would still let the request reach the protected handler
+		// even though the answer above already reported a failure.
+		c.Abort()
 		return
 	}
 

management/webserver/rpc/auth.go

@@ -90,7 +90,11 @@ func loadOrCreateToken(path string) (string, error) {
 	}
 	value := hex.EncodeToString(token)
 
-	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+	// 0750: the directory holds the secret of the control channel, so it is not
+	// left traversable by other users. It is a shared mount point whose mode is
+	// normally set by the deployment, so this only applies when this call is the
+	// one that creates it.
+	if err := os.MkdirAll(filepath.Dir(path), 0750); err != nil {
 		return "", err
 	}
 
@@ -105,7 +109,7 @@ func loadOrCreateToken(path string) (string, error) {
 	}
 
 	if _, err = file.WriteString(value + "\n"); err != nil {
-		file.Close()
+		_ = file.Close()
 		return "", err
 	}
 

management/webserver/utils/file.go

@@ -62,16 +62,16 @@ func RenameWriteFile(filename string, data []byte, perm os.FileMode) error {
 	renamed := false
 	defer func() {
 		if !renamed {
-			os.Remove(tmpName)
+			_ = os.Remove(tmpName)
 		}
 	}()
 
 	if err = tmpFile.Chmod(perm); err != nil {
-		tmpFile.Close()
+		_ = tmpFile.Close()
 		return err
 	}
 	if _, err = tmpFile.Write(data); err != nil {
-		tmpFile.Close()
+		_ = tmpFile.Close()
 		return err
 	}
 	if err = tmpFile.Close(); err != nil {

mcp_server/pkg/logger/logger.go

@@ -140,7 +140,7 @@ func Init(cfg *Config) error {
 // GetLogger 获取日志实例
 func GetLogger() *Logger {
 	if defaultLogger == nil {
-		Init(nil)
+		_ = Init(nil)
 	}
 
 	if defaultLogger == nil {