cnList double-closes file handle, masking close errors #32

New issue

Open

opened 2026-05-17 23:13:51 +02:00 by heiko · 1 comment

heiko commented

2026-05-17 23:13:51 +02:00

Owner

Summary

cmd/cert-proxy-server/cnlist.go closes the file twice:

defer cc.Close()  //nolint:errcheck   ← deferred close, error suppressed

cns := list.UniqStrings{}
if err = list.AddItemsFromReader(&cns, cc); err != nil {
    return nil, err
}

return cns, cc.Close()   // explicit close, error propagated

The explicit cc.Close() at the return propagates errors correctly, but the defer then closes the already-closed handle a second time. The deferred close's error is suppressed by //nolint:errcheck, hiding any issue.

Fix

Remove the defer and keep only the explicit cc.Close() in the return, or vice versa.

## Summary `cmd/cert-proxy-server/cnlist.go` closes the file twice: ```go defer cc.Close() //nolint:errcheck ← deferred close, error suppressed cns := list.UniqStrings{} if err = list.AddItemsFromReader(&cns, cc); err != nil { return nil, err } return cns, cc.Close() // explicit close, error propagated ``` The explicit `cc.Close()` at the return propagates errors correctly, but the `defer` then closes the already-closed handle a second time. The deferred close's error is suppressed by `//nolint:errcheck`, hiding any issue. ## Fix Remove the `defer` and keep only the explicit `cc.Close()` in the return, or vice versa.

heiko added the

security

label

2026-05-17 23:13:51 +02:00

heiko referenced this issue

2026-05-20 15:59:50 +02:00

Client CN with '/' in subject accesses subdirectory of clients/ config dir #31

heiko commented

2026-05-22 11:38:24 +02:00

Author

Owner

AI attribution comment added per repository instruction for this open issue.\n\n(co)authored by ai:gpt-5-codex