Enhance HTTP Server Configuration and File Permissions in file.go (#65)

* Enhance HTTP Server Configuration and File Permissions in file.go

Mitigation of Slowloris Attacks: By introducing read and write timeouts to the HTTP server configuration, we mitigate potential Slowloris attacks. Slowloris is a type of Denial of Service attack where a client holds as many connections to the server open as possible for a long time, effectively tying up all available connections and preventing legitimate users from accessing the server. By setting a limit on how long the server will wait for a complete request (ReadTimeout) or a complete response (WriteTimeout), we ensure that resources are not tied up indefinitely, thus reducing the effectiveness of Slowloris attacks.

Prevention of Unauthorized File Access: The file permissions for storing files have been updated to 0600 (read and write permissions for the owner only). This change is important for security reasons. By restricting access to the owner only, we reduce the risk of unauthorized access or manipulation of the stored files. This is particularly important when the files contain sensitive data, as it prevents potential data leaks or unauthorized modifications.

These were reported by gosec

Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>

* Exclude tests from gosec

Signed-off-by: John Kjell <john@testifysec.com>

---------

Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>
Signed-off-by: John Kjell <john@testifysec.com>
Co-authored-by: John Kjell <john@testifysec.com>

.golangci.yaml

@@ -0,0 +1,25 @@
+# Copyright 2024 The Archivista Contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+run:
+  timeout: 6m
+linters:
+  enable:
+    - gosec
+issues:
+  max-same-issues: 50
+  exclude-rules:
+    - path: _test.go
+      linters:
+        - gosec

cmd/archivista/main.go

@@ -141,13 +141,17 @@ func main() {
 	if err != nil {
 		logrus.Fatalf("unable to start http listener: %+v", err)
 	}
-
-	go func() {
-		if err := http.Serve(listener, handlers.CORS(
+	srv := &http.Server{
+		Handler: handlers.CORS(
 			handlers.AllowedOrigins(cfg.CORSAllowOrigins),
 			handlers.AllowedMethods([]string{"GET", "POST", "OPTIONS"}),
 			handlers.AllowedHeaders([]string{"Accept", "Content-Type", "Content-Length", "Accept-Encoding", "X-CSRF-Token", "Authorization"}),
-		)(server.Router())); err != nil {
+    )(server.Router()),
+		ReadTimeout:  5 * time.Second,
+		WriteTimeout: 10 * time.Second,
+	}
+	go func() {
+		if err := srv.Serve(listener); err != nil {
 			logrus.Fatalf("unable to start http server: %+v", err)
 		}
 	}()

internal/objectstorage/filestore/file.go

@@ -21,6 +21,7 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"time"
 
 	"github.com/gorilla/handlers"
 )
@@ -32,9 +33,23 @@ type Store struct {
 func New(ctx context.Context, directory string, address string) (*Store, <-chan error, error) {
 	errCh := make(chan error)
 	go func() {
-		server := handlers.CompressHandler(http.FileServer(http.Dir(directory)))
-		log.Fatalln(http.ListenAndServe(address, server))
+		server := &http.Server{
+			Addr:         address,
+			Handler:      handlers.CompressHandler(http.FileServer(http.Dir(directory))),
+			ReadTimeout:  5 * time.Second,
+			WriteTimeout: 10 * time.Second,
+		}
+
+		if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+			log.Fatalf("Could not listen on %s: %v\n", address, err)
+		}
+
 		<-ctx.Done()
+
+		if err := server.Shutdown(context.Background()); err != nil {
+			log.Fatalf("Server Shutdown Failed:%+v", err)
+		}
+
 		close(errCh)
 	}()
 
@@ -53,7 +68,7 @@ func (s *Store) Get(ctx context.Context, gitoid string) (io.ReadCloser, error) {
 
 func (s *Store) Store(ctx context.Context, gitoid string, payload []byte) error {
 	if filepath.IsLocal(gitoid) {
-		return os.WriteFile(filepath.Join(s.prefix, gitoid+".json"), payload, 0644)
+		return os.WriteFile(filepath.Join(s.prefix, gitoid+".json"), payload, 0o600)
 	} else {
 		return filepath.ErrBadPattern
 	}