checkmarx compliance, part 1

Signed-off-by: Abhishek Gaikwad <[email protected]>
Signed-off-by: Alex Aizman <[email protected]>

ais/dpq.go

@@ -67,7 +67,7 @@ func dpqFree(dpq *dpq) {
 // (This is a faster alternative to the conventional and RFC-compliant URL.Query()
 // to be used narrowly to handle those few (keys) and nothing else.)
 func (dpq *dpq) parse(rawQuery string) (err error) {
-	query := rawQuery
+	query := rawQuery // r.URL.RawQuery
 	for query != "" {
 		key, value := query, ""
 		if i := strings.IndexByte(key, '&'); i >= 0 {

ais/htrun.go

@@ -952,11 +952,14 @@ func (h *htrun) writeJS(w http.ResponseWriter, r *http.Request, v any, tag strin
 }
 
 func _writejs(w http.ResponseWriter, r *http.Request, v any) (err error) {
-	w.Header().Set(cos.HdrContentType, cos.ContentJSONCharsetUTF)
+	hdr := w.Header()
+	hdr.Set(cos.HdrContentType, cos.ContentJSONCharsetUTF)
 	if isBrowser(r.Header.Get(cos.HdrUserAgent)) {
 		var out []byte
 		if out, err = jsoniter.MarshalIndent(v, "", "    "); err == nil {
-			w.Header().Set(cos.HdrContentLength, strconv.Itoa(len(out)))
+			hdr.Set(cos.HdrContentLength, strconv.Itoa(len(out)))
+			// NOTE: Strict-Transport-Security
+			hdr.Set(cos.HdrHSTS, "max-age=31536000; includeSubDomains")
 			_, err = w.Write(out)
 		}
 	} else { // previously: new-encoder(w).encode(v) (non-browser client)
@@ -965,7 +968,7 @@ func _writejs(w http.ResponseWriter, r *http.Request, v any) (err error) {
 		j.WriteRaw("\n")
 		if err = j.Error; err == nil {
 			b := j.Buffer()
-			w.Header().Set(cos.HdrContentLength, strconv.Itoa(len(b)))
+			hdr.Set(cos.HdrContentLength, strconv.Itoa(len(b)))
 			_, err = w.Write(b)
 
 			// NOTE: consider http.NewResponseController(w).Flush()

cmd/cli/cli/verbfobj.go

@@ -73,6 +73,10 @@ func verbFobjs(c *cli.Context, wop wop, fobjs []fobj, bck cmn.Bck, ndir int, rec
 	if errU != nil {
 		return errU
 	}
+	if totalSize == 0 {
+		return fmt.Errorf("total size of all files is zero (%s, %v)", wop.verb(), fobjs)
+	}
+
 	if err := teb.Print(extSizes, tmpl, opts); err != nil {
 		return err
 	}

cmn/cos/http_headers.go

@@ -43,6 +43,8 @@ const (
 	HdrLocation  = "Location"
 	HdrServer    = "Server"
 	HdrETag      = "ETag" // Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag
+
+	HdrHSTS = "Strict-Transport-Security"
 )
 
 //

cmn/cos/io.go

@@ -11,6 +11,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"math"
 	"os"
 	"os/user"
 	"path/filepath"
@@ -282,6 +283,7 @@ func NewCallbackReadOpenCloser(r ReadOpenCloser, readCb func(int, error), report
 
 func (r *CallbackROC) Read(p []byte) (n int, err error) {
 	n, err = r.roc.Read(p)
+	debug.Assert(r.readBytes > math.MaxInt-n)
 	r.readBytes += n
 	if r.readBytes > r.reportedBytes {
 		diff := r.readBytes - r.reportedBytes
@@ -336,6 +338,7 @@ func (r *ReaderWithArgs) Close() (err error) {
 ///////////////////
 
 func NewSectionHandle(r io.ReaderAt, offset, size, padding int64) *SectionHandle {
+	debug.Assert(padding >= 0)
 	sec := io.NewSectionReader(r, offset, size)
 	return &SectionHandle{r, sec, offset, size, padding, 0}
 }
@@ -373,6 +376,9 @@ func (f *SectionHandle) Read(buf []byte) (n int, err error) {
 		buf[idx] = 0
 	}
 	n += int(fromPad)
+
+	// check for integer overflow
+	debug.Assert(f.padOffset <= math.MaxInt-fromPad)
 	f.padOffset += fromPad
 
 	if f.padOffset < f.padding {

ec/putjogger.go

@@ -90,6 +90,7 @@ func (*putJogger) newCtx(lom *core.LOM, meta *Metadata) (ctx *encodeCtx, err err
 	ctx.sliceSize = SliceSize(ctx.lom.Lsize(), ctx.dataSlices)
 	ctx.slices = make([]*slice, totalCnt)
 	ctx.padSize = ctx.sliceSize*int64(ctx.dataSlices) - ctx.lom.Lsize()
+	debug.Assert(ctx.padSize >= 0)
 
 	ctx.fh, err = cos.NewFileHandle(lom.FQN)
 	return ctx, err

transport/recv.go

@@ -334,8 +334,11 @@ func (it *iterator) nextObj(loghdr string, hlen int) (obj *objReader, err error)
 				if err != nil {
 					break
 				}
+				// Check for potential overflow before adding
+				debug.Assert(n <= math.MaxInt-m)
 				n += m
-				if n == hlen {
+				if n >= hlen {
+					debug.Assert(n == hlen)
 					break
 				}
 			}