Repository: git-bug/git-bug (language: go)

Issue:
Critical security vulnerabilities in Go's standard library
Go v1.19.4 is required to resolve all the security vulnerabilities listed by `govulncheck`:

```
govulncheck ./... 
govulncheck is an experimental tool. Share feedback at https://go.dev/s/govulncheck-feedback.

Scanning for dependencies with known vulnerabilities...
Found 3 known vulnerabilities.

Vulnerability #1: GO-2022-1144
  An attacker can cause excessive memory growth in a Go server
  accepting HTTP/2 requests. HTTP/2 server connections contain a
  cache of HTTP header keys sent by the client. While the total
  number of entries in this cache is capped, an attacker sending
  very large keys can cause the server to allocate approximately
  64 MiB per open connection.

  Call stacks in your code:
      commands/webui.go:194:26: github.com/MichaelMure/git-bug/commands.runWebUI calls net/http.Server.ListenAndServe

  Found in: net/http@go1.18.6
  Fixed in: net/http@go1.19.4
  More info: https://pkg.go.dev/vuln/GO-2022-1144

Vulnerability #2: GO-2022-0969
  HTTP/2 server connections can hang forever waiting for a clean
  shutdown that was preempted by a fatal error. This condition can
  be exploited by a malicious client to cause a denial of service.

  Call stacks in your code:
      commands/webui.go:194:26: github.com/MichaelMure/git-bug/commands.runWebUI calls net/http.Server.ListenAndServe

  Found in: net/http@go1.18.6
  Fixed in: net/http@go1.19.1
  More info: https://pkg.go.dev/vuln/GO-2022-0969

Vulnerability #3: GO-2022-1039
  Programs which compile regular expressions from untrusted
  sources may be vulnerable to memory exhaustion or denial of
  service. The parsed regexp representation is linear in the size
  of the input, but in some cases the constant factor can be as
  high as 40,000, making relatively small regexps consume much
  larger amounts of memory. After fix, each regexp being parsed is
  limited to a 256 MB memory footprint. Regular expressions whose
  representation would use more space than that are rejected.
  Normal use of regular expressions is unaffected.

  Call stacks in your code:
      repository/index_bleve.go:115:28: github.com/MichaelMure/git-bug/repository.bleveIndex.Search calls github.com/blevesearch/bleve.indexImpl.Search, which eventually calls regexp/syntax.Parse

  Found in: regexp/syntax@go1.18.6
  Fixed in: regexp/syntax@go1.19.2
  More info: https://pkg.go.dev/vuln/GO-2022-1039

=== Informational ===

The vulnerabilities below are in packages that you import, but your code
doesn't appear to call any vulnerable functions. You may not need to take any
action. See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck
for details.

Vulnerability #1: GO-2022-0988
  JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.
  Found in: net/url@go1.18.6
  Fixed in: net/url@go1.19.1
  More info: https://pkg.go.dev/vuln/GO-2022-0988
```


Discussion / hints:

Fix patch:
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index e5fcd1f11..16fb5d7e5 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -18,7 +18,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
-          go-version: 1.18.x
+          go-version: 1.19.4
       - uses: actions/checkout@v3
       # Run benchmark with `go test -bench` and stores the output to a file
       - name: Run benchmark
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 904005539..d0f2585d0 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -12,7 +12,7 @@ jobs:
 
     strategy:
       matrix:
-        go-version: [1.18.x]
+        go-version: [1.19.4]
         platform: [ubuntu-latest, macos-latest, windows-latest]
 
     runs-on: ${{ matrix.platform }}
@@ -20,7 +20,7 @@ jobs:
     steps:
 
       - name: Set up Go ${{ matrix.node-version }}
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v3
         with:
           go-version: ${{ matrix.go-version }}
 
@@ -44,13 +44,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Install Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v3
         with:
-          go-version: 1.18.x
+          go-version: 1.19.4
 
       - name: Checkout code
         uses: actions/checkout@v2
 
       - name: Check Code Formatting
         run: find . -name "*.go" | while read line; do [ -z "$(gofmt -d "$line" | head)" ] || exit 1; done
-
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a245f0526..80751500c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,9 +12,9 @@ jobs:
 
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v3
         with:
-          go-version: 1.18.x
+          go-version: 1.19.4
 
       - name: Check out code
         uses: actions/checkout@v2
@@ -38,4 +38,4 @@ jobs:
           repo_token: "${{ secrets.GITHUB_TOKEN }}"
           draft: true
           prerelease: false
-          files: dist/*
\ No newline at end of file
+          files: dist/*
diff --git a/go.mod b/go.mod
index 34081235e..d31566131 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/MichaelMure/git-bug
 
-go 1.18
+go 1.19
 
 require (
 	github.com/99designs/gqlgen v0.17.20


Test patch:
diff --git a/cache/repo_cache_test.go b/cache/repo_cache_test.go
index 796b5db9f..ac5a7c75d 100644
--- a/cache/repo_cache_test.go
+++ b/cache/repo_cache_test.go
@@ -130,6 +130,13 @@ func TestCache(t *testing.T) {
 	require.NoError(t, err)
 	_, err = cache.Bugs().ResolvePrefix(bug1.Id().String()[:10])
 	require.NoError(t, err)
+
+	// Close
+	require.NoError(t, cache.Close())
+	require.Empty(t, cache.bugs.cached)
+	require.Empty(t, cache.bugs.excerpts)
+	require.Empty(t, cache.identities.cached)
+	require.Empty(t, cache.identities.excerpts)
 }
 
 func TestCachePushPull(t *testing.T) {