Skip to content

Fix and feat - #133

Open
T1anjiu wants to merge 3 commits into
pldubouilh:masterfrom
T1anjiu:fix-and-feat
Open

Fix and feat#133
T1anjiu wants to merge 3 commits into
pldubouilh:masterfrom
T1anjiu:fix-and-feat

Conversation

@T1anjiu

@T1anjiu T1anjiu commented Apr 24, 2026

Copy link
Copy Markdown

Summary

This PR removes insecure hash algorithms (MD5 and SHA1) and fixes resource leaks in the file upload and zip download
functionality.

Changes

Security Improvements

  • Remove MD5 and SHA1: These algorithms are no longer considered secure and have been removed from the RPC hash
    function
  • Enhanced path validation: Use filepath.Clean() to sanitize paths and prevent directory traversal attacks
  • Directory existence check: Validate that the target directory exists and is accessible on startup

Bug Fixes

  • Fix file handle leak in upload: Added defer dst.Close() to ensure uploaded files are properly closed
  • Fix file handle leak in zipRPC: Changed from defer file.Close() to explicit file.Close() to avoid
    accumulating file handles in the filepath.Walk loop

Code Quality

  • Enhanced error logging: Improved error messages in verbose mode for better debugging
  • Replace deprecated imports: Updated io/ioutil to io in test code (Go 1.16+)

Testing

  • Existing tests pass (note: TestNormal has a pre-existing failure unrelated to these changes)
  • Manual testing confirms:
    • File upload works correctly
    • Zip download works correctly
    • Directory validation prevents invalid paths
    • Error messages are more informative in verbose mode

Breaking Changes

  • Hash algorithm changes: RPC calls using md5 or sha1 will now return an error. Users should update to use
    sha256 or sha512.

Checklist

  • Code follows project style
  • No new files added
  • Cross-platform compatible
  • Tests pass (pre-existing failures unrelated)

T1anjiu added 2 commits April 24, 2026 17:16
 - Remove MD5/SHA1, use SHA256/SHA512 only
 - Fix file handle leaks in upload and zipRPC
 - Enhance error logging and path validation
 - Add directory existence check on startup"
Comment thread gossa.go
Comment on lines -254 to 257
case "md5":
hash = md5.New()
case "sha1":
hash = sha1.New()
case "sha256":

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you keep md5 and sha1 ? It's cryptographically insecure, but still widely used by other systems for file stamping.

@pldubouilh

Copy link
Copy Markdown
Owner

Thank you for your PR ! I'm ready to accept it - just please bring back md5 and sha1, I know it's used by some users.

@T1anjiu

T1anjiu commented Apr 24, 2026

Copy link
Copy Markdown
Author

Thank you for your PR ! I'm ready to accept it - just please bring back md5 and sha1, I know it's used by some users.

Done. I've restored MD5 and SHA1 as suggested.

@pldubouilh

Copy link
Copy Markdown
Owner

Thank you ! I'll test it out a bit on my side and merge it later on !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants