security: fix critical/high auth, idor, races and persistence

app/gosqs/send_message.go

@@ -63,25 +63,27 @@ func SendMessageV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
 
 	key := tenantQueueKey(t.AccessKey, queueName)
 
-	if _, ok := models.SyncQueues.Queues[key]; !ok {
+	models.SyncQueues.RLock()
+	queue, exists := models.SyncQueues.Queues[key]
+	if !exists {
+		models.SyncQueues.RUnlock()
 		return utils.CreateErrorResponseV1("QueueNotFound", true)
 	}
+	maxMessageSize := queue.MaximumMessageSize
+	currentMsgCount := len(queue.Messages)
+	queueIsFIFO := queue.IsFIFO
+	delaySecs := queue.DelaySeconds
+	models.SyncQueues.RUnlock()
 
-	if models.SyncQueues.Queues[key].MaximumMessageSize > 0 &&
-		len(messageBody) > models.SyncQueues.Queues[key].MaximumMessageSize {
+	if maxMessageSize > 0 && len(messageBody) > maxMessageSize {
 		return utils.CreateErrorResponseV1("MessageTooBig", true)
 	}
 
 	// Fix #11: лимит сообщений в очереди — защита от OOM
-	models.SyncQueues.RLock()
-	currentMsgCount := len(models.SyncQueues.Queues[key].Messages)
-	queueIsFIFO := models.SyncQueues.Queues[key].IsFIFO
-	models.SyncQueues.RUnlock()
 	if currentMsgCount >= MaxMessagesForQueue(queueIsFIFO) {
 		return utils.CreateErrorResponseV1("OverLimit", true)
 	}
 
-	delaySecs := models.SyncQueues.Queues[key].DelaySeconds
 	if requestBody.DelaySeconds != 0 {
 		delaySecs = requestBody.DelaySeconds
 	}