fix: fix potential connection leaks on non-ok http status codes

Even the response of a non-ok http status code can contain a body. So we should close the body of a (on transport layer) sucessful request unconditionally. Otherwise we can leak a http connection.

Author: mgoetzegb

cmd/csaf_downloader/downloader.go

@@ -361,6 +361,7 @@ func (d *Downloader) loadOpenPGPKeys(
 			continue
 		}
 		if res.StatusCode != http.StatusOK {
+			res.Body.Close()
 			slog.Warn(
 				"Fetching public OpenPGP key failed",
 				"url", u,

cmd/csaf_downloader/forwarder.go

@@ -259,8 +259,8 @@ func (f *Forwarder) forward(
 			f.storeFailed(filename, doc, sha256, sha512)
 			return
 		}
+		defer res.Body.Close()
 		if res.StatusCode != http.StatusCreated {
-			defer res.Body.Close()
 			if msg, err := limitedString(res.Body, 512); err != nil {
 				slog.Error("reading forward result failed",
 					"error", err)

csaf/advisories.go

@@ -230,6 +230,7 @@ func (afp *AdvisoryFileProcessor) loadChanges(
 	if err != nil {
 		return nil, errs.ErrNetwork{Message: fmt.Sprintf("failed get request for url %s: %v", changesURL, err)}
 	}
+	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
 		switch { // we don't expect 401 and 403, as directory based feeds are supposed to be public, but just to be on the safe side
@@ -247,7 +248,6 @@ func (afp *AdvisoryFileProcessor) loadChanges(
 		}
 	}
 
-	defer resp.Body.Close()
 	var files []AdvisoryFile
 	c := csv.NewReader(resp.Body)
 	// format specification:
@@ -331,6 +331,7 @@ func (afp *AdvisoryFileProcessor) processROLIE(
 			continue
 		}
 		if res.StatusCode != http.StatusOK {
+			res.Body.Close()
 			slog.Error("Fetching failed",
 				"url", feedURL, "status_code", res.StatusCode, "status", res.Status)
 			switch {

csaf/providermetaloader.go

@@ -248,6 +248,7 @@ func (pmdl *ProviderMetadataLoader) loadFromSecurity(domain string) []*LoadedPro
 			continue
 		}
 		if res.StatusCode != http.StatusOK {
+			res.Body.Close()
 			pmdl.messages.Add(
 				HTTPFailed,
 				fmt.Sprintf("Fetching %q failed: %s (%d)", path, res.Status, res.StatusCode))
@@ -305,6 +306,7 @@ func (pmdl *ProviderMetadataLoader) loadFromURL(path string) *LoadedProviderMeta
 		return &result
 	}
 	if res.StatusCode != http.StatusOK {
+		defer res.Body.Close()
 		result.Messages.Add(
 			HTTPFailed,
 			fmt.Sprintf("fetching %q failed: %s (%d)", path, res.Status, res.StatusCode))

csaf/remotevalidation.go

@@ -300,6 +300,7 @@ func (v *remoteValidator) Validate(doc any) (*RemoteValidationResult, error) {
 	if err != nil {
 		return nil, err
 	}
+	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
 		return nil, fmt.Errorf(
@@ -312,7 +313,6 @@ func (v *remoteValidator) Validate(doc any) (*RemoteValidationResult, error) {
 	)
 
 	if err := func() error {
-		defer resp.Body.Close()
 		var in io.Reader
 		// If we are caching record the incoming data and compress it.
 		if key != nil {