fix: use time.NewTicker in rateLimiter to prevent goroutine leak

Author: ZPascal

api.go

@@ -333,13 +333,15 @@ type rateLimiter struct {
 	buckets map[string]*rateBucket
 	limit   int
 	window  time.Duration
+	done    chan struct{}
 }
 
 func newRateLimiter(limit int) *rateLimiter {
 	rl := &rateLimiter{
 		buckets: make(map[string]*rateBucket),
 		limit:   limit,
 		window:  time.Minute,
+		done:    make(chan struct{}),
 	}
 	go rl.cleanup()
 	return rl
@@ -362,18 +364,29 @@ func (rl *rateLimiter) allow(ip string) bool {
 }
 
 func (rl *rateLimiter) cleanup() {
-	for range time.Tick(10 * time.Minute) {
-		rl.mu.Lock()
-		now := time.Now()
-		for ip, b := range rl.buckets {
-			if now.After(b.resetAt) {
-				delete(rl.buckets, ip)
+	ticker := time.NewTicker(10 * time.Minute)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ticker.C:
+			rl.mu.Lock()
+			now := time.Now()
+			for ip, b := range rl.buckets {
+				if now.After(b.resetAt) {
+					delete(rl.buckets, ip)
+				}
 			}
+			rl.mu.Unlock()
+		case <-rl.done:
+			return
 		}
-		rl.mu.Unlock()
 	}
 }
 
+func (rl *rateLimiter) stop() {
+	close(rl.done)
+}
+
 func rateLimitMiddleware(rl *rateLimiter, next httprouter.Handle) httprouter.Handle {
 	return func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
 		if rl == nil {

api_test.go

@@ -621,6 +621,7 @@ func TestRegisterRateLimit(t *testing.T) {
 	Config.API.HeaderName = "X-Forwarded-For"
 
 	limiter := newRateLimiter(Config.API.RegisterRateLimit)
+	defer limiter.stop()
 
 	api2 := httprouter.New()
 	api2.POST("/register", rateLimitMiddleware(limiter, webRegisterPost))