refactor(opflags): update some logic for clarity and safety

Author: tgragnato

.golangci.yml

@@ -30,23 +30,19 @@ linters:
       - linters:
           - gosec
         text: 'G115: integer overflow conversion'
-      
-      - linters:
-          - gosec
-        text: 'G602: slice index out of range'
-
-      - linters:
-          - govet
-        text: 'buildtag: \+build line is no longer needed'
 
       - linters:
           - staticcheck
         text: 'ST1001: should not use dot imports'
-      
+
       - linters:
+          - gosec
+        text: 'G703: Path traversal via taint analysis'
+
+      - linters:
+          - gosec
           - staticcheck
-        text: 'this check suggests that the pointer can be nil'
-        path: persistence/postgres_test.go
+        path: _test\.go$
 
     paths:
       - third_party$

merkle/merkle.go

@@ -22,7 +22,7 @@ func Root(hashes [][sha256.Size]byte) [sha256.Size]byte {
 		panic(fmt.Sprintf("expected power of two number of hashes, got %d", numHashes))
 	}
 	var next [][sha256.Size]byte
-	for i := 0; i < len(hashes); i += 2 {
+	for i := 0; i < len(hashes)-1; i += 2 {
 		left := hashes[i]
 		right := hashes[i+1]
 		h := sha256.Sum256(append(left[:], right[:]...))

opflags/load_cred.go

@@ -10,11 +10,11 @@ import (
 )
 
 func (o *OpFlags) LoadCred() error {
-	if o.Cred == "" {
+	if o.CredentialsPath == "" {
 		return nil
 	}
 
-	file, err := os.Open(o.Cred)
+	file, err := os.Open(o.CredentialsPath)
 	if err != nil {
 		return fmt.Errorf("error while opening file: %s", err.Error())
 	}

opflags/load_cred_test.go

@@ -47,8 +47,8 @@ func TestLoadCred(t *testing.T) {
 
 			// Initialize OpFlags with the temporary file path
 			o := &OpFlags{
-				Cred:        tmpfile.Name(),
-				Credentials: make(map[string][]byte),
+				CredentialsPath: tmpfile.Name(),
+				Credentials:     make(map[string][]byte),
 			}
 
 			// Call LoadCred and check the result

opflags/opflags.go

@@ -24,10 +24,10 @@ type OpFlags struct {
 	FilterNodesCIDRs   []string `long:"filter-nodes-cidrs" description:"List of CIDRs on which Magnetico can operate. Empty is open mode." default:"" yaml:"filterNodesCIDRs"`
 	FilterNodesIpNets  []net.IPNet
 
-	Addr        string `short:"a" long:"addr"        description:"Address (host:port) to serve on" default:"[::1]:8080" yaml:"addr"`
-	Cred        string `short:"c" long:"credentials" description:"Path to the credentials file" default:"" yaml:"cred"`
-	Credentials map[string][]byte
-	Timeout     uint `short:"t" long:"timeout" description:"Timeout in seconds for the web interface and APIs." default:"600" yaml:"timeout"`
+	Addr            string `short:"a" long:"addr"        description:"Address (host:port) to serve on" default:"[::1]:8080" yaml:"addr"`
+	CredentialsPath string `short:"c" long:"credentials" description:"Path to the credentials file" default:"" yaml:"cred"`
+	Credentials     map[string][]byte
+	Timeout         uint `short:"t" long:"timeout" description:"Timeout in seconds for the web interface and APIs." default:"600" yaml:"timeout"`
 
 	RunDaemon bool `short:"d" long:"daemon" description:"Run the crawler without the web interface." yaml:"runDaemon"`
 	RunWeb    bool `short:"w" long:"web"    description:"Run the web interface without the crawler." yaml:"runWeb"`

opflags/opflags_test.go

@@ -66,8 +66,8 @@ func TestCheck(t *testing.T) {
 		{
 			name: "RunWebWithInvalidCred",
 			opFlags: OpFlags{
-				RunWeb: true,
-				Cred:   "invalid-cred",
+				RunWeb:          true,
+				CredentialsPath: "invalid-cred",
 			},
 			expectError: true,
 		},