wdevs/ResolveSpec
3
0
Fork 0
mirror of https://github.com/bitechdev/ResolveSpec.git synced 2025-12-31 17:28:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add security improvements and race condition protection

Browse Source 
Co-authored-by: warkanum <208308+warkanum@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2025-12-30 11:14:59 +00:00
parent ccf8522f88
commit 4f8edd6469
2 changed files with 35 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
pkg/server/manager_test.go
View File

@@ -332,9 +332,10 @@ func TestShutdownCallbacks(t *testing.T) {
func TestSelfSignedSSLCertificateReuse(t *testing.T) {
logger.Init(true)
// Get cert directory to verify file creation
certDir, err := getCertDirectory()
// Get expected cert directory location
cacheDir, err := os.UserCacheDir()
require.NoError(t, err)
certDir := filepath.Join(cacheDir, "resolvespec", "certs")
host := "localhost"
certFile := filepath.Join(certDir, fmt.Sprintf("%s-cert.pem", host))

36
pkg/server/tls.go
View File

@@ -13,11 +13,15 @@ import (
"net"
"os"
"path/filepath"
"sync"
"time"
"golang.org/x/crypto/acme/autocert"
)
// certGenerationMutex protects concurrent certificate generation for the same host
var certGenerationMutex sync.Mutex
// generateSelfSignedCert generates a self-signed certificate for the given host.
// Returns the certificate and private key in PEM format.
func generateSelfSignedCert(host string) (certPEM, keyPEM []byte, err error) {
@@ -75,6 +79,20 @@ func generateSelfSignedCert(host string) (certPEM, keyPEM []byte, err error) {
return certPEM, keyPEM, nil
}
// sanitizeHostname converts a hostname to a safe filename by replacing invalid characters.
func sanitizeHostname(host string) string {
// Replace any character that's not alphanumeric, dot, or dash with underscore
safe := ""
for _, r := range host {
if (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') || r == '.' || r == '-' {
safe += string(r)
} else {
safe += "_"
}
}
return safe
}
// getCertDirectory returns the directory path for storing self-signed certificates.
// Creates the directory if it doesn't exist.
func getCertDirectory() (string, error) {
@@ -139,9 +157,12 @@ func saveCertToFiles(certPEM, keyPEM []byte, host string) (certFile, keyFile str
return "", "", err
}
// Sanitize hostname for safe file naming
safeHost := sanitizeHostname(host)
// Use consistent file names based on host
certFile = filepath.Join(certDir, fmt.Sprintf("%s-cert.pem", host))
keyFile = filepath.Join(certDir, fmt.Sprintf("%s-key.pem", host))
certFile = filepath.Join(certDir, fmt.Sprintf("%s-cert.pem", safeHost))
keyFile = filepath.Join(certDir, fmt.Sprintf("%s-key.pem", safeHost))
// Write certificate
if err := os.WriteFile(certFile, certPEM, 0600); err != nil {
@@ -224,6 +245,13 @@ func configureTLS(cfg Config) (*tls.Config, string, string, error) {
host = "localhost"
}
// Sanitize hostname for safe file naming
safeHost := sanitizeHostname(host)
// Lock to prevent concurrent certificate generation for the same host
certGenerationMutex.Lock()
defer certGenerationMutex.Unlock()
// Get certificate directory
certDir, err := getCertDirectory()
if err != nil {
@@ -231,8 +259,8 @@ func configureTLS(cfg Config) (*tls.Config, string, string, error) {
}
// Check for existing valid certificates
certFile := filepath.Join(certDir, fmt.Sprintf("%s-cert.pem", host))
keyFile := filepath.Join(certDir, fmt.Sprintf("%s-key.pem", host))
certFile := filepath.Join(certDir, fmt.Sprintf("%s-cert.pem", safeHost))
keyFile := filepath.Join(certDir, fmt.Sprintf("%s-key.pem", safeHost))
// If valid certificates exist, reuse them
if isCertificateValid(certFile) {