security fixes

Author: shcherbak

README.md

@@ -82,7 +82,7 @@ Data file with modules for [exporter_exporter](https://github.com/QubitProducts/
 }
 ```
 
-Prometheus SD config with 
+Prometheus SD config with
 [relabel_config](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config) example
 ```yaml
 scrape_configs:
@@ -133,7 +133,7 @@ docker build -t ghcr.io/code-tool/inventor/inventor:$(cat VERSION.txt) --build-a
 ```
 pulling image:
 ```bash
-ghcr.io/code-tool/inventor/inventor:0.2.0
+ghcr.io/code-tool/inventor/inventor:0.3.0
 ```
 
 ## License

VERSION.txt

@@ -1 +1 @@
-0.2.0
+0.3.0

charts/inventor/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
 name: inventor
-version: 0.2.0
+version: 0.3.0
 sources:
   - https://github.com/shcherbak/inventor

charts/inventor/values.yaml

@@ -13,12 +13,12 @@ secret:
   SD_TOKEN: 'ChangeMe'
 
 main:
-  image: "ghcr.io/code-tool/inventor/inventor:0.2.0"
+  image: "ghcr.io/code-tool/inventor/inventor:0.3.0"
   pullPolicy: "IfNotPresent"
 
 redis:
   enabled: true
-  image: "redis:8.2.3"
+  image: "redis:8.2.5"
   pullPolicy: "IfNotPresent"
 
 service:

docker/Dockerfile

@@ -1,5 +1,5 @@
-FROM golang:1.25.5-trixie AS builder
-ARG BUILD_VERSION='0.2.0'
+FROM golang:1.25.9-trixie AS builder
+ARG BUILD_VERSION='0.3.0'
 ENV LISTEN_PORT=9101
 WORKDIR /opt/inventor/
 COPY go.mod ./

src/handler/middleware.go

@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"strings"
 	"sync"
+	"crypto/subtle"
 
 	"github.com/google/uuid"
 	"github.com/redis/go-redis/v9"
@@ -140,6 +141,7 @@ func (s *SDTargetsMiddleware) handleGetByGroupName(w http.ResponseWriter, r *htt
 }
 
 func (s *SDTargetsMiddleware) handleInsert(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, 64*1024) // 64 KB
 	var req StaticConfigDocument
 	var res IDDocument
 	err := json.NewDecoder(r.Body).Decode(&req)
@@ -162,6 +164,7 @@ func (s *SDTargetsMiddleware) handleInsert(w http.ResponseWriter, r *http.Reques
 }
 
 func (s *SDTargetsMiddleware) handleDelete(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, 64*1024)
 	var req IDDocument
 	err := json.NewDecoder(r.Body).Decode(&req)
 	if err != nil {
@@ -181,6 +184,7 @@ func (s *SDTargetsMiddleware) handleDelete(w http.ResponseWriter, r *http.Reques
 }
 
 func (s *SDTargetsMiddleware) handleGetByID(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, 64*1024)
 	var req IDDocument
 	err := json.NewDecoder(r.Body).Decode(&req)
 	if err != nil {
@@ -212,20 +216,12 @@ func (s *SDTargetsMiddleware) HealthCheck(w http.ResponseWriter, r *http.Request
 
 func (s *SDTargetsMiddleware) isApiTokenValid(r *http.Request) bool {
 	token := r.Header.Get("x-api-token")
-	if token != s.ApiToken {
-		return false
-	} else {
-		return true
-	}
+  return subtle.ConstantTimeCompare([]byte(token), []byte(s.ApiToken)) == 1
 }
 
 func (s *SDTargetsMiddleware) isSdTokenValid(r *http.Request) bool {
 	token := r.Header.Get("x-sd-token")
-	if token != s.SdToken {
-		return false
-	} else {
-		return true
-	}
+	return subtle.ConstantTimeCompare([]byte(token), []byte(s.SdToken)) == 1
 }
 
 func (s *SDTargetsMiddleware) forbiddenResponse(w http.ResponseWriter) {

src/handler/targets.go

@@ -86,7 +86,7 @@ func (c *SDTargets) Scan(ctx context.Context, con *redis.Client) (SDTargets, err
 		}
 	}
 	if err := iter.Err(); err != nil {
-		panic(err)
+		return targets, err
 	}
 	return targets, nil
 }

src/main.go

@@ -13,6 +13,7 @@ import (
 	"strconv"
 	"sync"
 	"syscall"
+	"time"
 
 	"github.com/google/uuid"
 	"github.com/prometheus/client_golang/prometheus"
@@ -76,6 +77,9 @@ func configureServer() {
 	server = &http.Server{
 		Addr:    fmt.Sprintf(":%s", config.GetConfig().LISTEN_PORT),
 		Handler: nil,
+		ReadTimeout:  10 * time.Second,
+		WriteTimeout: 30 * time.Second,
+		IdleTimeout:  60 * time.Second,
 	}
 	server.RegisterOnShutdown(func() {
 		log.Println("Shutting down server.")