Nail/SQS-service
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: fix critical/high auth, idor, races and persistence

Browse Source
This commit is contained in:
Naeel
2026-04-10 19:41:59 +03:00
parent e9a26f7975
commit a5e9bfb15c
11 changed files with 868 additions and 505 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/gosqs/get_queue_url.go
+33 -32
View File
@@ -3,44 +3,45 @@
package gosqs
import (
"net/http"
"net/http"
"shared-sqs/app/interfaces"
"shared-sqs/app/models"
"shared-sqs/app/utils"
log "github.com/sirupsen/logrus"
"shared-sqs/app/interfaces"
"shared-sqs/app/models"
"shared-sqs/app/utils"
log "github.com/sirupsen/logrus"
)
func GetQueueUrlV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
requestBody := models.NewGetQueueUrlRequest()
ok := utils.REQUEST_TRANSFORMER(requestBody, req, false)
if !ok {
log.Error("Invalid Request - GetQueueUrlV1")
return utils.CreateErrorResponseV1("InvalidParameterValue", true)
}
requestBody := models.NewGetQueueUrlRequest()
ok := utils.REQUEST_TRANSFORMER(requestBody, req, false)
if !ok {
log.Error("Invalid Request - GetQueueUrlV1")
return utils.CreateErrorResponseV1("InvalidParameterValue", true)
}
t := getTenantFromContext(req)
if t == nil {
return utils.CreateErrorResponseV1("InvalidClientTokenId", true)
}
t := getTenantFromContext(req)
if t == nil {
return utils.CreateErrorResponseV1("InvalidClientTokenId", true)
}
queueName := requestBody.QueueName
key := tenantQueueKey(t.AccessKey, queueName)
queueName := requestBody.QueueName
key := tenantQueueKey(t.AccessKey, queueName)
// Fix #10: RLock перед чтением SyncQueues — иначе data race
models.SyncQueues.RLock()
queue, ok := models.SyncQueues.Queues[key]
models.SyncQueues.RUnlock()
if !ok {
log.Errorf("Get Queue URL: %s, queue does not exist for tenant %s", queueName, t.ID)
return utils.CreateErrorResponseV1("QueueNotFound", true)
}
log.Debug("Get Queue URL:", queue.Name)
// Fix #10: RLock перед чтением SyncQueues — иначе data race
models.SyncQueues.RLock()
queue, ok := models.SyncQueues.Queues[key]
models.SyncQueues.RUnlock()
if !ok {
log.Errorf("Get Queue URL: %s, queue does not exist for tenant %s", queueName, t.ID)
return utils.CreateErrorResponseV1("QueueNotFound", true)
}
log.Debug("Get Queue URL:", queue.Name)
respStruct := models.GetQueueUrlResponse{
Xmlns: models.BaseXmlns,
Result: models.GetQueueUrlResult{QueueUrl: queue.URL},
Metadata: models.BaseResponseMetadata,
}
return http.StatusOK, respStruct
respStruct := models.GetQueueUrlResponse{
Xmlns: models.BaseXmlns,
Result: models.GetQueueUrlResult{QueueUrl: queue.URL},
Metadata: models.BaseResponseMetadata,
}
return http.StatusOK, respStruct
}