security: fix critical/high auth, idor, races and persistence

app/gosqs/list_queues.go

@@ -4,48 +4,48 @@
 package gosqs
 
 import (
-"net/http"
-"strings"
+	"net/http"
+	"strings"
 
-"shared-sqs/app/interfaces"
-"shared-sqs/app/models"
-"shared-sqs/app/utils"
-log "github.com/sirupsen/logrus"
+	log "github.com/sirupsen/logrus"
+	"shared-sqs/app/interfaces"
+	"shared-sqs/app/models"
+	"shared-sqs/app/utils"
 )
 
 func ListQueuesV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
-requestBody := models.NewListQueuesRequest()
-ok := utils.REQUEST_TRANSFORMER(requestBody, req, true)
-if !ok {
-log.Error("Invalid Request - ListQueuesV1")
-return utils.CreateErrorResponseV1("InvalidParameterValue", true)
-}
+	requestBody := models.NewListQueuesRequest()
+	ok := utils.REQUEST_TRANSFORMER(requestBody, req, true)
+	if !ok {
+		log.Error("Invalid Request - ListQueuesV1")
+		return utils.CreateErrorResponseV1("InvalidParameterValue", true)
+	}
 
-t := getTenantFromContext(req)
-if t == nil {
-return utils.CreateErrorResponseV1("InvalidClientTokenId", true)
-}
+	t := getTenantFromContext(req)
+	if t == nil {
+		return utils.CreateErrorResponseV1("InvalidClientTokenId", true)
+	}
 
-log.Infof("Listing Queues for tenant: %s", t.ID)
-queueUrls := make([]string, 0)
-prefix := t.AccessKey + ":"
+	log.Infof("Listing Queues for tenant: %s", t.ID)
+	queueUrls := make([]string, 0)
+	prefix := t.AccessKey + ":"
 
-models.SyncQueues.Lock()
-for key, queue := range models.SyncQueues.Queues {
-// Показываем только очереди этого тенанта
-if strings.HasPrefix(key, prefix) {
-if strings.HasPrefix(queue.Name, requestBody.QueueNamePrefix) {
-queueUrls = append(queueUrls, queue.URL)
-}
-}
-}
-models.SyncQueues.Unlock()
+	models.SyncQueues.RLock()
+	for key, queue := range models.SyncQueues.Queues {
+		// Показываем только очереди этого тенанта
+		if strings.HasPrefix(key, prefix) {
+			if strings.HasPrefix(queue.Name, requestBody.QueueNamePrefix) {
+				queueUrls = append(queueUrls, queue.URL)
+			}
+		}
+	}
+	models.SyncQueues.RUnlock()
 
-respStruct := models.ListQueuesResponse{
-Xmlns:    models.BaseXmlns,
-Metadata: models.BaseResponseMetadata,
-Result:   models.ListQueuesResult{QueueUrls: queueUrls},
-}
+	respStruct := models.ListQueuesResponse{
+		Xmlns:    models.BaseXmlns,
+		Metadata: models.BaseResponseMetadata,
+		Result:   models.ListQueuesResult{QueueUrls: queueUrls},
+	}
 
-return http.StatusOK, respStruct
+	return http.StatusOK, respStruct
 }