From 5d88c1b2fa37430dd9ad3e2f3390d5bfb823c972 Mon Sep 17 00:00:00 2001 From: Dmitry Verkhoturov Date: Sat, 18 Apr 2026 05:26:50 +0100 Subject: [PATCH] fix(api): drop QR-write nolint dup + trim dead `..` check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Address PR #2045 review (umputun): * The //nolint:gosec on telegramQrCtrl's w.Write(png) was byte-identical to the same line in #2044 (gosec-rule restoration). Drop it here so the two PRs do not conflict; #2044 owns it. * `seg == ".."` in safePictureSegment was already covered by the strings.Contains(seg, "..") check two lines down — trim and add an inline comment so the cover-by-superset is explicit. --- backend/app/rest/api/rest_public.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/backend/app/rest/api/rest_public.go b/backend/app/rest/api/rest_public.go index b9491942..4b34c0b4 100644 --- a/backend/app/rest/api/rest_public.go +++ b/backend/app/rest/api/rest_public.go @@ -373,13 +373,13 @@ func (s *public) listCtrl(w http.ResponseWriter, r *http.Request) { // etc.) also closes a log-injection vector since the rejected segment is // echoed into the access log. func safePictureSegment(seg string) bool { - if seg == "" || seg == "." || seg == ".." { + if seg == "" || seg == "." { return false } if strings.ContainsAny(seg, "/\\") { return false } - if strings.Contains(seg, "..") { + if strings.Contains(seg, "..") { // also covers seg == ".." return false } for _, r := range seg { @@ -464,7 +464,7 @@ func (s *public) telegramQrCtrl(w http.ResponseWriter, r *http.Request) { } w.Header().Set("Content-Type", "image/png") - if _, err = w.Write(png); err != nil { //nolint:gosec // png bytes from go-qrcode, not HTML + if _, err = w.Write(png); err != nil { log.Printf("[WARN] can't render qr, %v", err) } }