Skip to content

Fix low-severity audit findings across all modules#13

Merged
ConsoleTVs merged 12 commits into
mainfrom
fix/low-severity-audit-findings
Apr 12, 2026
Merged

Fix low-severity audit findings across all modules#13
ConsoleTVs merged 12 commits into
mainfrom
fix/low-severity-audit-findings

Conversation

@ConsoleTVs
Copy link
Copy Markdown
Member

Summary

Fourth and final tier of fixes from the comprehensive security and quality audit. This PR addresses low-severity findings across all modules — code style, doc comments, naming conventions, test consistency, import grouping, and minor ergonomic improvements.

Contract

  • Rename abbreviated parameters (kname, dfallback) in ParamInt/QueryInt variants
  • Standardize doc comments from bulleted parameter lists to concise prose style
  • Add t.Parallel() to all test functions across 13 test files
  • Add NeedsRehash doc comment on Rehashable interface
  • Fix WithTransaction doc wording about nested operations

Router

  • Rewrite all doc comments: start with symbol name, end with period, fix typos
  • Remove redundant zero-value initializers (pattern: "", parent: nil) in New()
  • Rename Record parameter rrequest for full-word convention
  • Add panic message assertions in dot-dot and empty-method tests
  • Remove stale RecordHandler cross-reference

Problem

  • Remove unused embed import (no //go:embed directive)
  • Fix all doc comments: Problem type interfaces, With/Without copy-on-write, Error/Errors/Unwrap descriptions, MarshalJSON/UnmarshalJSON behavior, Defaulted field enumeration, typo fixes
  • Replace make([]error, 0) with var for nil-error fast path
  • Use strings.Builder instead of += concatenation in textHandler
  • Use httptest.NewRequest in accept_test.go

Framework Core

  • Add doc comment on handleError explaining error inspection logic
  • Extract StatusClientClosedRequest = 499 constant replacing magic number
  • Initialize afterResponseHooks in NewHooks for consistency with other hook slices
  • Add mutex doc comment in Hooks struct
  • Fix ServerOptions doc to cover all zero-valued fields
  • Use t.Context() in handler_test.go for proper test cancellation

Middleware

  • Fix import grouping to three groups (stdlib/cosmos/external) in all 7 test files
  • Rename abbreviated receiver rsreaderStringer in recover_test.go
  • Fix RecoverWith doc to suggest interface pattern instead of referencing unexported type
  • Remove redundant 1 * in rate limit CleanupInterval default
  • Remove compile-time interface check on test-only testTextMarshaler
  • Improve Provide doc with parameter guidance and retrieval example

Session

  • Remove redundant sync.Mutex{} zero-value initialization
  • Fix informal comment and Regenerate/Delete doc inaccuracies
  • Replace string literal "GET" with http.MethodGet in all tests
  • Export CacheDriverOptions.Prefix field for external configurability
  • Fix import grouping in all test files

Cache

  • Fix import grouping to three groups in all files
  • Align redis doc comments with memory counterparts (Delete, Has, Forever, Increment, Decrement)
  • Remove named return values from redis Pull method
  • Document Pull's non-atomic nature in memory implementation

Crypto

  • Rename TestItCan* tests to TestAES*/TestChaCha20* naming convention
  • Rename abbreviated variables eencrypter, cypherciphertext
  • Align ChaCha20 struct field order with AES (key, aead, AdditionalData)
  • Add ChaCha20 concurrency safety doc note matching AES
  • Fix import grouping in test files

Hash

  • Rename TestItCan* tests to TestArgon2*/TestBcrypt* naming convention
  • Rename abbreviated variables hhasher, rhashed
  • Replace manual all-zero byte loops with require.Equal assertions
  • Use parenthesized import in argon2.go for consistency
  • Fix import grouping in test files

Database

  • Fix import grouping to three groups in both source and test files
  • Replace &sql.TxOptions{} with nil for idiomatic driver defaults

Event

  • Fix import grouping to three groups in all source and test files
  • Replace fmt.Sprintf with strconv.FormatUint for subscription IDs
  • Use var declarations instead of empty composite literals for zero-value types
  • Remove unnecessary var() grouping for single ErrBrokerClosed
  • Fix deliverToHandler doc comment accuracy
  • Add explicit _ = for discarded Close errors in AMQP broker

Breaking Changes

CacheDriverOptions.Prefix is now exported

What changed: prefix field renamed to Prefix.

Migration: If constructing CacheDriverOptions with struct literal, rename prefixPrefix.

Why: The struct is exported but the field was unexported, making it unconfigurable by external callers.

StatusClientClosedRequest constant added

What changed: New exported constant StatusClientClosedRequest = 499.

Migration: No migration needed — this is a new export. Callers can optionally use it instead of magic number 499.

- Rename abbreviated params: k->name, d->fallback in ParamInt/QueryInt variants
- Standardize doc comments from bulleted parameter lists to concise prose
- Add t.Parallel() to all test functions across all contract test files
- Add NeedsRehash doc comment on Rehashable interface
- Fix WithTransaction doc wording about nested operations
- Rewrite all doc comments to start with symbol name, end with period
- Fix typos: recursivity->recursion, an handler->a handler, responses->requests and responses
- Remove redundant zero-value initializers in New()
- Rename Record parameter r->request for full-word convention
- Add panic message assertions in dot-dot and empty-method tests
- Remove stale RecordHandler reference
…uilder

- Remove unused embed import (no //go:embed directive)
- Fix all doc comments: Problem type interfaces, With/Without copy-on-write,
  Error/Errors/Unwrap descriptions, MarshalJSON/UnmarshalJSON behavior,
  Defaulted field enumeration, strack-trace typo
- Add magic number comment for +5 RFC 9457 fields
- Fix internal/accept.go doc comments: Accept type, find grammar, Order ordering
- Replace make([]error, 0) with var for nil-error fast path
- Use strings.Builder instead of += concatenation in textHandler
- Use httptest.NewRequest in accept_test.go
…tant, hook fixes

- Add doc comment on handleError explaining error inspection logic
- Extract StatusClientClosedRequest = 499 constant replacing magic number
- Initialize afterResponseHooks in NewHooks for consistency
- Add mutex doc comment in Hooks struct
- Fix ServerOptions doc to cover all zero-valued fields
- Use t.Context() in handler_test.go for proper test cancellation
…t consistency

- Separate imports into three groups (stdlib/cosmos/external) in all test files
- Rename abbreviated receiver rs->readerStringer in recover_test.go
- Fix RecoverWith doc to suggest interface pattern instead of unexported type
- Remove redundant 1* in rate limit CleanupInterval default
- Remove compile-time interface check on test-only testTextMarshaler
- Improve Provide doc comment with parameter guidance and retrieval example
….Prefix

- Remove redundant sync.Mutex zero-value initialization
- Fix informal comment and Regenerate/Delete doc inaccuracies
- Replace string literal "GET" with http.MethodGet in all tests
- Export CacheDriverOptions.Prefix field for external configurability
- Fix import grouping in all test files
…l atomicity

- Fix import grouping to three groups in memory.go, redis.go, memory_test.go
- Align redis doc comments with memory counterparts (Delete, Has, Forever, Increment, Decrement)
- Remove named return values from redis Pull method
- Document Pull's non-atomic nature in memory.go
…uct field order

- Rename TestItCan* tests to TestAES*/TestChaCha20* naming convention
- Rename abbreviated variable e->encrypter and cypher->ciphertext
- Align ChaCha20 struct field order with AES (key, aead, AdditionalData)
- Add ChaCha20 concurrency safety doc note matching AES
- Fix import grouping in test files
…r zero checks

- Rename TestItCan* tests to TestArgon2*/TestBcrypt* naming convention
- Rename abbreviated variables h->hasher, r->hashed
- Replace manual all-zero byte loops with require.Equal assertions
- Use parenthesized import in argon2.go for consistency
- Fix import grouping in test files
- Separate imports into three groups (stdlib/cosmos/external)
- Replace &sql.TxOptions{} with nil for idiomatic driver defaults
- Fix import grouping to three groups in all source and test files
- Replace fmt.Sprintf with strconv.FormatUint for subscription IDs
- Use var declarations instead of empty composite literals for zero-value types
- Remove unnecessary var() grouping for single ErrBrokerClosed
- Fix deliverToHandler doc comment accuracy
- Add explicit _ = for discarded Close errors in AMQP broker
@ConsoleTVs ConsoleTVs marked this pull request as ready for review April 12, 2026 15:12
…t-findings

# Conflicts:
#	contract/hash.go
#	contract/request/body_test.go
#	framework/cache/memory.go
#	framework/cache/redis.go
#	framework/crypto/chacha20.go
#	framework/event/memory.go
#	framework/event/redis.go
#	framework/hash/bcrypt_test.go
#	framework/middleware/recover.go
#	router/router.go
@ConsoleTVs ConsoleTVs merged commit 9fb463a into main Apr 12, 2026
3 checks passed
@ConsoleTVs ConsoleTVs deleted the fix/low-severity-audit-findings branch April 12, 2026 15:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant