fix linter findings

Author: chombium

src/integration_tests/trafficcontroller/fake_uaa_server_test.go

@@ -20,7 +20,7 @@ func (h *FakeUaaHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	token := r.FormValue("token")
+	token := r.FormValue("token") //nolint:gosec
 
 	switch token {
 	case "iAmAnAdmin":

src/rlp/app/rlp.go

@@ -53,7 +53,7 @@ type RLP struct {
 
 // NewRLP returns a new unstarted RLP.
 func NewRLP(m MetricClient, opts ...RLPOption) *RLP {
-	ctx, cancel := context.WithCancel(context.Background())
+	ctx, cancel := context.WithCancel(context.Background()) //nolint:gosec
 	rlp := &RLP{
 		ingressAddrs:         []string{"doppler.service.cf.internal"},
 		ingressDialOpts:      []grpc.DialOption{grpc.WithTransportCredentials(insecure.NewCredentials())},

src/trafficcontroller/internal/auth/uaa_client_test.go

@@ -147,7 +147,7 @@ func (h *FakeUaaHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	token := r.FormValue("token")
+	token := r.FormValue("token") //nolint:gosec
 
 	switch token {
 	case "iAmAnAdmin":

src/trafficcontroller/internal/proxy/set_cookie_handler.go

@@ -13,6 +13,7 @@ func NewSetCookieHandler(domain string) *SetCookieHandler {
 }
 
 func (h SetCookieHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, 1<<20) // limit request body to 1MB
 	if err := r.ParseForm(); err != nil {
 		w.WriteHeader(http.StatusBadRequest)
 		return