fix(audit): satisfy lint for downloader hardening

commit: 1ec93bfbfa39f13e3e3704f813b110ab33a6edb3
author: brice · 4mo ago · 2026-06-11 04:10 UTC
parent: a19ed71
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

2 files · +11 -5

M internal/infrastructure/filtering/downloader.go +3 -3


@@ -7,7 +7,7 @@ import (
7	7		"io"
8	8		"net/http"
9	9		"os"
10		-	"path"
	10	+	pathpkg "path"
11	11		"path/filepath"
12	12		"strings"
13	13		"time"

@@ -312,8 +312,8 @@ func validateFilterFilename(filename string) (string, error) {
312	312		}
313	313		}
314	314
315		-	clean := path.Clean(filename)
316		-	if path.Ext(clean) != ".json" {
	315	+	clean := pathpkg.Clean(filename)
	316	+	if pathpkg.Ext(clean) != ".json" {
317	317		return "", fmt.Errorf("invalid filter filename %q: expected .json extension", filename)
318	318		}
319	319


@@ -7,7 +7,7 @@ import (
7		"io"	7		"io"
8		"net/http"	8		"net/http"
9		"os"	9		"os"
10	-	"path"	10	+	pathpkg "path"
11		"path/filepath"	11		"path/filepath"
12		"strings"	12		"strings"
13		"time"	13		"time"

@@ -312,8 +312,8 @@ func validateFilterFilename(filename string) (string, error) {
312		}	312		}
313		}	313		}
314			314
315	-	clean := path.Clean(filename)	315	+	clean := pathpkg.Clean(filename)
316	-	if path.Ext(clean) != ".json" {	316	+	if pathpkg.Ext(clean) != ".json" {
317		return "", fmt.Errorf("invalid filter filename %q: expected .json extension", filename)	317		return "", fmt.Errorf("invalid filter filename %q: expected .json extension", filename)
318		}	318		}
319			319

M internal/infrastructure/filtering/downloader_test.go +8 -2


@@ -122,7 +122,10 @@ func TestDownloader_DownloadFilters_AllowsSafeNestedManifestFilenames(t *testing
122	122
123	123		func TestDownloader_FetchManifest_RejectsOversizedManifest(t *testing.T) {
124	124		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
125		-	require.Equal(t, "/"+FilterFiles.Manifest, r.URL.Path)
	125	+	if r.URL.Path != "/"+FilterFiles.Manifest {
	126	+	http.NotFound(w, r)
	127	+	return
	128	+	}
126	129		_, _ = io.WriteString(w, strings.Repeat("x", 17))
127	130		}))
128	131		defer server.Close()

@@ -148,7 +151,10 @@ func TestDownloader_FetchManifest_RejectsTooManyFiles(t *testing.T) {
148	151		require.NoError(t, err)
149	152
150	153		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
151		-	require.Equal(t, "/"+FilterFiles.Manifest, r.URL.Path)
	154	+	if r.URL.Path != "/"+FilterFiles.Manifest {
	155	+	http.NotFound(w, r)
	156	+	return
	157	+	}
152	158		_, _ = w.Write(payload)
153	159		}))
154	160		defer server.Close()

 func TestDownloader_FetchManifest_RejectsOversizedManifest(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/"+FilterFiles.Manifest, r.URL.Path)
+		if r.URL.Path != "/"+FilterFiles.Manifest {
+			http.NotFound(w, r)
+			return
+		}
 		_, _ = io.WriteString(w, strings.Repeat("x", 17))
 	}))
 	defer server.Close()
 	require.NoError(t, err)
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/"+FilterFiles.Manifest, r.URL.Path)
+		if r.URL.Path != "/"+FilterFiles.Manifest {
+			http.NotFound(w, r)
+			return
+		}
 		_, _ = w.Write(payload)
 	}))
 	defer server.Close()