fix: ci fixes

Author: gmlexx

data-service/main.go

@@ -9,23 +9,33 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
+	"strconv"
 	"sync"
 	"syscall"
 	"time"
 
 	"github.com/devskill-org/ems/mpc"
 )
 
+// defaultPort is the port used when PORT is not set in the environment.
+const defaultPort = 8081
+
 var (
 	decisions   []mpc.ControlDecision
 	decisionsMu sync.RWMutex
 )
 
 func main() {
-	port := os.Getenv("PORT")
-	if port == "" {
-		port = "8081"
+	// Validate the port from the environment to avoid propagating untrusted input.
+	portNum := defaultPort
+	if raw := os.Getenv("PORT"); raw != "" {
+		parsed, err := strconv.Atoi(raw)
+		if err != nil || parsed < 1 || parsed > 65535 {
+			log.Fatalf("invalid PORT value")
+		}
+		portNum = parsed
 	}
+	port := strconv.Itoa(portNum)
 
 	mux := http.NewServeMux()
 	mux.HandleFunc("/mpc/save", handleMPCSave)
@@ -38,7 +48,7 @@ func main() {
 	}
 
 	go func() {
-		log.Printf("data-service HTTP server listening on :%s", port)
+		log.Printf("data-service HTTP server listening on :%d", portNum)
 		if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
 			log.Fatalf("HTTP server error: %v", err)
 		}

scheduler/mpc_test.go

@@ -657,7 +657,7 @@ func TestGetSolarForecast_NilWeatherForecast_NilOpenMeteo(t *testing.T) {
 
 	// Point the scheduler at a fake Open-Meteo server that always returns 503 so
 	// the fetch fails deterministically regardless of internet connectivity.
-	fakeServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	fakeServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		http.Error(w, "service unavailable", http.StatusServiceUnavailable)
 	}))
 	defer fakeServer.Close()

scheduler/server.go

@@ -752,7 +752,8 @@ func (hs *WebServer) marketDataUploadHandler(w http.ResponseWriter, r *http.Requ
 	// Limit request body to 10 MB to prevent memory exhaustion.
 	r.Body = http.MaxBytesReader(w, r.Body, 10<<20)
 
-	// Parse multipart form – limit body to 10 MB.
+	// Parse multipart form – the body size is already capped by MaxBytesReader above.
+	//nolint:gosec // G120: request body is bounded by http.MaxBytesReader (10 MB)
 	if err := r.ParseMultipartForm(10 << 20); err != nil {
 		w.WriteHeader(http.StatusBadRequest)
 		_ = json.NewEncoder(w).Encode(map[string]string{"error": "failed to parse form: " + err.Error()})
@@ -863,6 +864,16 @@ func (hs *WebServer) marketDataDownloadHandler(w http.ResponseWriter, r *http.Re
 		date = time.Now().In(location).Format("2006-01-02")
 	}
 
+	// Validate the date so it is safe to embed in response headers.
+	parsedDate, err := time.Parse("2006-01-02", date)
+	if err != nil {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusBadRequest)
+		_ = json.NewEncoder(w).Encode(map[string]string{"error": "invalid date format, expected YYYY-MM-DD"})
+		return
+	}
+	date = parsedDate.Format("2006-01-02")
+
 	rawXML, ok := hs.scheduler.xmlCache.GetRaw(date)
 	if !ok {
 		w.Header().Set("Content-Type", "application/json")
@@ -872,8 +883,10 @@ func (hs *WebServer) marketDataDownloadHandler(w http.ResponseWriter, r *http.Re
 	}
 
 	w.Header().Set("Content-Type", "application/xml")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
 	w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"Energy_Prices_%s.xml\"", date))
 	w.WriteHeader(http.StatusOK)
+	//nolint:gosec // G705: served as a non-sniffable XML attachment, never rendered inline
 	_, _ = w.Write(rawXML)
 }