github-vet / github-vet/preliminary-findings-jan-2021

ghetzel/diecast: server.go; 77 LoC

Open
#4,635 0 comments 0 reactions 0 assignees View on GitHub
fresh medium
Dominant language
No language data
Stars
0
Forks
0
PR merge metrics
No merged PRs in 30d

Description

Found a possible issue in [ghetzel/diecast](https://www.github.com/ghetzel/diecast) at [server.go](https://github.com/ghetzel/diecast/blob/fb7285473bed6770ab0e7af5463974138a44a4a1/server.go#L2516-L2592)

Below is the message reported by the analyzer for this snippet of code. Beware that the analyzer only reports the first issue it finds, so please do not limit your consideration to the contents of the below message.

> range-loop variable scmd used in defer or goroutine at line 2570

[Click here to see the code in its original context.](https://github.com/ghetzel/diecast/blob/fb7285473bed6770ab0e7af5463974138a44a4a1/server.go#L2516-L2592)

Click here to show the 77 line(s) of Go which triggered the analyzer.

```go
for _, scmd := range scmds {
if cmdline := scmd.Command; cmdline != `` {
if tokens, err := shellwords.Parse(cmdline); err == nil {
scmd.cmd = exec.Command(tokens[0], tokens[1:]...)
scmd.cmd.SysProcAttr = &syscall.SysProcAttr{
Setpgid: true,
}

var env = make(map[string]interface{})

for _, pair := range os.Environ() {
key, value := stringutil.SplitPair(pair, `=`)
env[key] = value
}

for key, value := range scmd.Environment {
env[key] = value
}

env[`DIECAST`] = true
env[`DIECAST_BIN`] = self.BinPath
env[`DIECAST_DEBUG`] = self.EnableDebugging
env[`DIECAST_ADDRESS`] = self.Address
env[`DIECAST_ROOT`] = self.RootPath
env[`DIECAST_PATH_LAYOUTS`] = self.LayoutPath
env[`DIECAST_PATH_ERRORS`] = self.ErrorsPath
env[`DIECAST_BINDING_PREFIX`] = self.BindingPrefix
env[`DIECAST_ROUTE_PREFIX`] = self.rp()

for key, value := range env {
scmd.cmd.Env = append(scmd.cmd.Env, fmt.Sprintf("%v=%v", key, value))
}

if dir := scmd.Directory; dir != `` {
if xdir, err := pathutil.ExpandUser(dir); err == nil {
if absdir, err := filepath.Abs(xdir); err == nil {
scmd.cmd.Dir = absdir
} else {
return false, err
}
} else {
return false, err
}
}

if prewait, err := timeutil.ParseDuration(scmd.WaitBefore); err == nil && prewait > 0 {
log.Infof("Waiting %v before running command", prewait)
time.Sleep(prewait)
}

if wait, err := timeutil.ParseDuration(scmd.Wait); err == nil {
var waitchan = make(chan error)

go func() {
log.Infof("Executing command: %v", strings.Join(scmd.cmd.Args, ` `))
waitchan <- scmd.cmd.Run()
}()

time.Sleep(wait)

var xerr error

if waitForCommand {
xerr = <-waitchan
}

if xerr != nil || scmd.ExitOnCompletion {
return scmd.ExitOnCompletion, xerr
}
} else {
return false, err
}
} else {
return false, fmt.Errorf("invalid command: %v", err)
}
}
}

```

Leave a reaction on this issue to contribute to the project by classifying this instance as a **Bug** :-1:, **Mitigated** :+1:, or **Desirable Behavior** :rocket:
See the descriptions of the classifications [here](https://github.com/github-vet/rangeclosure-findings#how-can-i-help) for more information.

commit ID: fb7285473bed6770ab0e7af5463974138a44a4a1

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in server.go at lines 2516-2592 and inspect the scmd loop, especially the goroutine near line 2570. Run the repository's Go tests, then verify that concurrent command execution uses the intended command data for each iteration and that existing command behavior remains unchanged.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.