Code quality #25
Reference in New Issue
Block a user
No description provided.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
High: The shared IdP cache is not concurrency-safe and can panic under real mail traffic. The cache is a plain map with no locking at internal/mailcloak/cache.go (line 5), while policy requests are handled in separate goroutines at internal/mailcloak/policy.go (line 48) and both provider clients read/write that cache at internal/mailcloak/keycloak.go (line 113), internal/mailcloak/keycloak.go (line 142), internal/mailcloak/authentik.go (line 114), and internal/mailcloak/authentik.go (line 129). Two concurrent lookups can produce a concurrent map read and map write crash.
High: A single unexpected Accept error can permanently disable one listener, and the main process will not notice or recover. Both servers exit on the first non-shutdown Accept error at internal/mailcloak/policy.go (line 38) and internal/mailcloak/socketmap.go (line 34). Start only records the error at internal/mailcloak/run.go (line 75) and internal/mailcloak/run.go (line 87), while the daemon entrypoint waits only for OS signals at cmd/mailcloak/main.go (line 41). That leaves the process alive but partially dead until an external restart.
Medium: Service shutdown leaks the opened SQLite handle. The DB is opened and stored at internal/mailcloak/run.go (line 57), but Service.Close only closes listeners at internal/mailcloak/run.go (line 111). In tests or embedded use that start/stop services repeatedly, this can keep WAL/FD state open longer than intended.
Medium: Socket startup blindly deletes the configured path before binding, even if it is not a stale socket. Both listeners call os.Remove(sock) unconditionally at internal/mailcloak/policy.go (line 20) and internal/mailcloak/socketmap.go (line 16). A bad config path can unlink an unrelated file before startup fails.
Medium: mailcloakctl exposes application secrets through process arguments and shell history. The CLI takes the app password as a positional argument at mailcloakctl (line 397), hashes it at mailcloakctl (line 304), and the README documents that pattern at README.md (line 149). On multi-user systems, that leaks credentials via ps, audit logs, and shell history.