Merge pull request #3194 from semaphoreui/copilot/fix-03578144-9001-4905-9b7a-8c0500083ac2

Fix critical bugs in Go codebase: mutex ordering, slice bounds, and error handling

Author: fiftin

api/apps.go

@@ -22,6 +22,7 @@ func appMiddleware(next http.Handler) http.Handler {
 		appID, err := helpers.GetStrParam("app_id", w, r)
 		if err != nil {
 			helpers.WriteErrorStatus(w, err.Error(), http.StatusBadRequest)
+			return
 		}
 
 		if err := validateAppID(appID); err != nil {

api/user.go

@@ -52,7 +52,10 @@ func getAPITokens(w http.ResponseWriter, r *http.Request) {
 	}
 
 	for i := range tokens {
-		tokens[i].ID = tokens[i].ID[:8]
+		if len(tokens[i].ID) >= 8 {
+			tokens[i].ID = tokens[i].ID[:8]
+		}
+		// If ID is shorter than 8 chars, leave it as-is
 	}
 
 	helpers.WriteJSON(w, http.StatusOK, tokens)

cli/setup/setup.go

@@ -296,7 +296,8 @@ func askValue(prompt string, defaultValue string, item any) {
 
 	_, _ = fmt.Sscanln(defaultValue, item)
 
-	scanErrorChecker(fmt.Scanln(item))
+	n, err := fmt.Scanln(item)
+	scanErrorChecker(n, err)
 
 	// Empty line after prompt
 	fmt.Println("")
@@ -312,7 +313,8 @@ func askConfirmation(prompt string, defaultValue bool, item *bool) {
 
 	var answer string
 
-	scanErrorChecker(fmt.Scanln(&answer))
+	n, err := fmt.Scanln(&answer)
+	scanErrorChecker(n, err)
 
 	switch strings.ToLower(answer) {
 	case "y", "yes":

db/factory/store.go

@@ -24,4 +24,6 @@ func CreateStore() db.Store {
 	default:
 		panic("Unsupported database dialect: " + config.Dialect)
 	}
+	// This line should never be reached due to panic above, but satisfies linter
+	return nil
 }

go.mod

@@ -17,7 +17,6 @@ require (
 	github.com/gorilla/websocket v1.5.3
 	github.com/lib/pq v1.10.9
 	github.com/mdp/qrterminal/v3 v3.2.1
-	github.com/pkg/errors v0.9.1
 	github.com/pquerna/otp v1.4.0
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/semaphoreui/semaphore/pro v0.0.0

services/schedules/SchedulePool.go

@@ -195,8 +195,8 @@ func (p *SchedulePool) clear() {
 }
 
 func (p *SchedulePool) Destroy() {
-	defer p.locker.Unlock()
 	p.locker.Lock()
+	defer p.locker.Unlock()
 	p.cron.Stop()
 	p.clear()
 	p.cron = nil