Files

Check / check (pull_request) Successful in 3m25s

Details

fix: resolve all 22 gosec G710 open-redirect findings

Route every app redirect in internal/handlers/app.go through a new
redirectToApp helper that parses the app ID with ulid.ParseStrict
(404 on failure), re-serializes it, and path-escapes it before
building the /apps/<id> target, so no unvalidated request input can
reach http.Redirect. Also converts the equivalent unflagged redirect
in HandleAppCreate for consistency.

make lint under golangci-lint 2.12.2 drops from 47 findings to 25
(remaining: 1 gosec G703 tracked in #177, 24 goconst tracked in
#178). make test and make fmt-check pass unchanged.

Closes #176

2026-08-07 16:58:10 +00:00

2.7 KiB

Raw Permalink Blame History

Workflow

branch (from main)
do the work in Next Step
move Next Step to the top of Completed Steps
move the top item of Future Steps into Next Step
commit (TODO.md changes in the same commit as the work)
merge to main if the branch is not protected, otherwise open a PR
push

Status

1.0+. Tagged 1.0.0 on 2026-02-26. Policy violation: main currently fails make check under golangci-lint >= 2.12 (25 lint issues remaining: 1 gosec G703, 24 goconst), so the tree is out of compliance until fixed. CI (Dockerfile lint stage, pinned golangci-lint v2.10.1) is green; the pin bump is tracked in issue #179. The road to release 1.1.0 is tracked in Gitea issues #175-#185 (milestone 1.1.0).

Next Step

Fix the gosec G703 path traversal finding in the deploy log download handler (issue #177): canonicalize and containment-check the log path before http.ServeFile, with a traversal-rejection test.

Completed Steps

2026-08-07: Fixed all 22 gosec G710 open-redirect findings: app redirects go through a redirectToApp helper that ULID-validates the app ID (#176).
2026-08-07: Fixed all 47 noctx lint findings: tests now use httptest.NewRequestWithContext with t.Context() (#175).
2026-07-07 Adopted scripts-to-rule-them-all: script/ entrypoints, Makefile shims, README Entrypoints section
2026-03-11: Monolithic env var editing with bulk save (#158).
2026-03-10: Webhook event history UI page (#164); added missing Makefile docker and hooks targets plus test timeout (#159); notification settings passed from create form (#160).
2026-03-03: REPO_POLICIES compliance file set added (#155).
2026-03-01: Module path changed to sneak.berlin/go/upaas (#143); Dockerfile split into lint and build stages with forced lint execution (#152, #154).
2026-02-26: 1.0.0 tagged; dashboard CSRFField crash fixed (#146).
1.0 audit bug fixes (#120-#125): deferred rollback on commit error, deployment log size cap, error path rendering, docker-compose bind mount, domain type refactor.
CI simplified to docker build only (#130).
2025-12-29 onward: core PaaS built out: deploys with real-time build log streaming, container start/stop/restart and logs, TCP/UDP port mapping, Alpine.js UI, Slack notifications, ULID app IDs, session handling.

Future Steps

Get main green (compliance, ordered):
- Fix 1 gosec G703 finding (Next Step, #177).
- Fix 24 goconst findings (#178).
- Bump Dockerfile golangci-lint pin to v2.12.x (#179).
- Run make check clean on main and keep it green; main must always pass.
Confirm .gitea/workflows/check.yml gates merges on make check so main cannot regress (#180).
Deploy to fsn1app1 and verify end-to-end (#181), then tag 1.1.0 (#182).
Resume feature work only after main is green.