From f09b01b6246beaf73d4ba9db0af7354646fb2fc6 Mon Sep 17 00:00:00 2001 From: Dmitry S Date: Thu, 15 Feb 2024 17:09:13 +0100 Subject: [PATCH] fix semgrep dgryski.semgrep-go issues Fix most of the semgrep issues with the http://semgrep.dev/r/dgryski.semgrep-go ruleset (`semgrep --config http://semgrep.dev/r/dgryski.semgrep-go`). Left the issue with Content-Type text/plain on json.Encode in endpoints/openrtb2/amp_auction.go since changing to application/json breaks the AMP unit tests, and issues with the pointer receiver for MarshalJSON in usersync/cookie.go. Fix #3509. Signed-off-by: Dmitry S --- endpoints/events/event.go | 8 ++++---- endpoints/events/vtrack.go | 12 ++++++------ endpoints/openrtb2/amp_auction.go | 5 +++-- endpoints/openrtb2/auction.go | 2 +- 4 files changed, 14 insertions(+), 13 deletions(-) diff --git a/endpoints/events/event.go b/endpoints/events/event.go index b92b72f17ad..e202932aff8 100644 --- a/endpoints/events/event.go +++ b/endpoints/events/event.go @@ -70,7 +70,7 @@ func (e *eventEndpoint) Handle(w http.ResponseWriter, r *http.Request, _ httprou w.WriteHeader(http.StatusBadRequest) for _, err := range errs { - w.Write([]byte(fmt.Sprintf("invalid request: %s\n", err.Error()))) + fmt.Fprintf(w, "invalid request: %s\n", err.Error()) } return @@ -81,7 +81,7 @@ func (e *eventEndpoint) Handle(w http.ResponseWriter, r *http.Request, _ httprou if err != nil { w.WriteHeader(http.StatusUnauthorized) - w.Write([]byte(fmt.Sprintf("Account '%s' is required query parameter and can't be empty", AccountIdParameter))) + fmt.Fprintf(w, "Account '%s' is required query parameter and can't be empty", AccountIdParameter) return } eventRequest.AccountID = accountId @@ -105,7 +105,7 @@ func (e *eventEndpoint) Handle(w http.ResponseWriter, r *http.Request, _ httprou w.WriteHeader(status) for _, message := range messages { - w.Write([]byte(fmt.Sprintf("Invalid request: %s\n", message))) + fmt.Fprintf(w, "Invalid request: %s\n", message) } return } @@ -113,7 +113,7 @@ func (e *eventEndpoint) Handle(w http.ResponseWriter, r *http.Request, _ httprou // Check if events are enabled for the account if !account.Events.Enabled { w.WriteHeader(http.StatusUnauthorized) - w.Write([]byte(fmt.Sprintf("Account '%s' doesn't support events", eventRequest.AccountID))) + fmt.Fprintf(w, "Account '%s' doesn't support events", eventRequest.AccountID) return } diff --git a/endpoints/events/vtrack.go b/endpoints/events/vtrack.go index 5d794651ba4..a2e185f4ba9 100644 --- a/endpoints/events/vtrack.go +++ b/endpoints/events/vtrack.go @@ -74,7 +74,7 @@ func (v *vtrackEndpoint) Handle(w http.ResponseWriter, r *http.Request, _ httpro // account id is required if accountId == "" { w.WriteHeader(http.StatusBadRequest) - w.Write([]byte(fmt.Sprintf("Account '%s' is required query parameter and can't be empty", AccountParameter))) + fmt.Fprintf(w, "Account '%s' is required query parameter and can't be empty", AccountParameter) return } @@ -82,7 +82,7 @@ func (v *vtrackEndpoint) Handle(w http.ResponseWriter, r *http.Request, _ httpro integrationType, err := getIntegrationType(r) if err != nil { w.WriteHeader(http.StatusBadRequest) - w.Write([]byte(fmt.Sprintf("Invalid integration type: %s\n", err.Error()))) + fmt.Fprintf(w, "Invalid integration type: %s\n", err.Error()) return } @@ -92,7 +92,7 @@ func (v *vtrackEndpoint) Handle(w http.ResponseWriter, r *http.Request, _ httpro // check if there was any error while parsing puts request if err != nil { w.WriteHeader(http.StatusBadRequest) - w.Write([]byte(fmt.Sprintf("Invalid request: %s\n", err.Error()))) + fmt.Fprintf(w, "Invalid request: %s\n", err.Error()) return } @@ -106,7 +106,7 @@ func (v *vtrackEndpoint) Handle(w http.ResponseWriter, r *http.Request, _ httpro w.WriteHeader(status) for _, message := range messages { - w.Write([]byte(fmt.Sprintf("Invalid request: %s\n", message))) + fmt.Fprintf(w, "Invalid request: %s\n", message) } return } @@ -118,7 +118,7 @@ func (v *vtrackEndpoint) Handle(w http.ResponseWriter, r *http.Request, _ httpro if len(errs) > 0 { w.WriteHeader(http.StatusInternalServerError) for _, err := range errs { - w.Write([]byte(fmt.Sprintf("Error(s) updating vast: %s\n", err.Error()))) + fmt.Fprintf(w, "Error(s) updating vast: %s\n", err.Error()) return } @@ -128,7 +128,7 @@ func (v *vtrackEndpoint) Handle(w http.ResponseWriter, r *http.Request, _ httpro if err != nil { w.WriteHeader(http.StatusInternalServerError) - w.Write([]byte(fmt.Sprintf("Error serializing pbs cache response: %s\n", err.Error()))) + fmt.Fprintf(w, "Error serializing pbs cache response: %s\n", err.Error()) return } diff --git a/endpoints/openrtb2/amp_auction.go b/endpoints/openrtb2/amp_auction.go index a6ad8d3fc65..10db42b1cd2 100644 --- a/endpoints/openrtb2/amp_auction.go +++ b/endpoints/openrtb2/amp_auction.go @@ -171,7 +171,7 @@ func (deps *endpointDeps) AmpAuction(w http.ResponseWriter, r *http.Request, _ h if errortypes.ContainsFatalError(errL) { w.WriteHeader(http.StatusBadRequest) for _, err := range errortypes.FatalOnly(errL) { - w.Write([]byte(fmt.Sprintf("Invalid request: %s\n", err.Error()))) + fmt.Fprintf(w, "Invalid request: %s\n", err.Error()) } labels.RequestStatus = metrics.RequestStatusBadInput return @@ -224,7 +224,7 @@ func (deps *endpointDeps) AmpAuction(w http.ResponseWriter, r *http.Request, _ h w.WriteHeader(httpStatus) labels.RequestStatus = metricsStatus for _, err := range errortypes.FatalOnly(errL) { - w.Write([]byte(fmt.Sprintf("Invalid request: %s\n", err.Error()))) + fmt.Fprintf(w, "Invalid request: %s\n", err.Error()) } ao.Errors = append(ao.Errors, acctIDErrs...) return @@ -387,6 +387,7 @@ func sendAmpResponse( // Fixes #231 enc := json.NewEncoder(w) enc.SetEscapeHTML(false) + w.Header().Set("Content-Type", "text/plain; charset=utf-8") // If an error happens when encoding the response, there isn't much we can do. // If we've sent _any_ bytes, then Go would have sent the 200 status code first. diff --git a/endpoints/openrtb2/auction.go b/endpoints/openrtb2/auction.go index c7beceb1b52..df919ea3b68 100644 --- a/endpoints/openrtb2/auction.go +++ b/endpoints/openrtb2/auction.go @@ -2375,7 +2375,7 @@ func writeError(errs []error, w http.ResponseWriter, labels *metrics.Labels) boo w.WriteHeader(httpStatus) labels.RequestStatus = metricsStatus for _, err := range errs { - w.Write([]byte(fmt.Sprintf("Invalid request: %s\n", err.Error()))) + fmt.Fprintf(w, "Invalid request: %s\n", err.Error()) } rc = true }