feat: Enhance Security, HTTP Robustness, and Git Operations

pkg/adapter/adapter.go

@@ -93,11 +93,13 @@ func (l *listener) Start(ctx context.Context) error {
 
 	mux.HandleFunc("/", l.handleEvent(ctx))
 
-	//nolint: gosec
 	srv := &http.Server{
 		Addr: ":" + adapterPort,
 		Handler: http.TimeoutHandler(mux,
 			httpTimeoutHandler, "Listener Timeout!\n"),
+		ReadHeaderTimeout: 5 * time.Second,
+		ReadTimeout:       10 * time.Second,
+		IdleTimeout:       30 * time.Second,
 	}
 
 	enabled, tlsCertFile, tlsKeyFile := l.isTLSEnabled()

pkg/cmd/tknpac/bootstrap/route.go

@@ -59,7 +59,9 @@ func detectSelfSignedCertificate(ctx context.Context, url string) string {
 	} else if err != nil {
 		return fmt.Sprintf("⚠️ could not connect to the route %s, make sure the pipelines-as-code controller is running", url)
 	}
-	resp.Body.Close()
+	if err := resp.Body.Close(); err != nil {
+		return fmt.Sprintf("⚠️ could not close the response body: %v", err)
+	}
 	return ""
 }
 

pkg/cmd/tknpac/bootstrap/web.go

@@ -7,6 +7,7 @@ import (
 	"log"
 	"net/http"
 	"path/filepath"
+	"time"
 
 	"github.com/openshift-pipelines/pipelines-as-code/pkg/cli/browser"
 	"github.com/openshift-pipelines/pipelines-as-code/pkg/cli/info"
@@ -19,7 +20,13 @@ import (
 func startWebServer(ctx context.Context, opts *bootstrapOpts, run *params.Run, jeez string) error {
 	m := http.NewServeMux()
 	//nolint: gosec
-	s := http.Server{Addr: fmt.Sprintf(":%d", opts.webserverPort), Handler: m}
+	s := http.Server{
+		Addr:              fmt.Sprintf(":%d", opts.webserverPort),
+		Handler:           m,
+		ReadHeaderTimeout: 5 * time.Second,
+		ReadTimeout:       10 * time.Second,
+		IdleTimeout:       30 * time.Second,
+	}
 	codeCh := make(chan string)
 	m.HandleFunc("/", func(rw http.ResponseWriter, r *http.Request) {
 		code := r.URL.Query().Get("code")

pkg/cmd/tknpac/generate/generate.go

@@ -195,7 +195,7 @@ func (o *Opts) samplePipeline(recreateTemplate bool) error {
 	}
 
 	if _, err := os.Stat(dirPath); os.IsNotExist(err) {
-		if err := os.MkdirAll(dirPath, 0o755); err != nil {
+		if err := os.MkdirAll(dirPath, 0o750); err != nil {
 			return err
 		}
 		fmt.Fprintf(o.IOStreams.Out, "%s Directory %s has been created.\n",
@@ -226,8 +226,7 @@ func (o *Opts) samplePipeline(recreateTemplate bool) error {
 		return err
 	}
 
-	//nolint: gosec
-	err = os.WriteFile(fpath, tmpl.Bytes(), 0o644)
+	err = os.WriteFile(fpath, tmpl.Bytes(), 0o600)
 	if err != nil {
 		return fmt.Errorf("cannot write template to %s: %w", fpath, err)
 	}

pkg/cmd/tknpac/info/globbing_test.go

@@ -67,7 +67,7 @@ func TestGlobbing(t *testing.T) {
 			tmpdir := fs.NewDir(t, t.Name())
 			defer tmpdir.Remove()
 			for _, file := range tt.files {
-				assert.NilError(t, os.MkdirAll(filepath.Dir(filepath.Join(tmpdir.Path(), file)), 0o755))
+				assert.NilError(t, os.MkdirAll(filepath.Dir(filepath.Join(tmpdir.Path(), file)), 0o750))
 				f, err := os.Create(filepath.Join(tmpdir.Path(), file))
 				assert.NilError(t, err)
 				_, _ = f.WriteString("")

pkg/cmd/tknpac/list/list.go

@@ -188,6 +188,5 @@ func list(ctx context.Context, cs *params.Run, opts *cli.PacCliOpts, ioStreams *
 	if err := t.Execute(w, data); err != nil {
 		return err
 	}
-	w.Flush()
-	return nil
+	return w.Flush()
 }

pkg/git/git.go

@@ -3,6 +3,7 @@ package git
 import (
 	"bytes"
 	"fmt"
+	"os"
 	"os/exec"
 	"strings"
 )
@@ -24,6 +25,12 @@ func RunGit(dir string, args ...string) (string, error) {
 	args = append([]string{"-c", "commit.gpgsign=false"}, args...)
 
 	c := exec.Command(gitPath, args...)
+	c.Env = []string{
+		"PATH=" + os.Getenv("PATH"),
+		"HOME=" + os.Getenv("HOME"),
+		"LC_ALL=C",
+		"LANG=C",
+	}
 	var output bytes.Buffer
 	c.Stderr = &output
 	c.Stdout = &output

test/pkg/scm/scm.go

@@ -106,7 +106,7 @@ func PushFilesToRefGit(t *testing.T, opts *Opts, entries map[string]string) stri
 	assert.NilError(t, err)
 
 	for filename, content := range entries {
-		assert.NilError(t, os.MkdirAll(filepath.Dir(filename), 0o755))
+		assert.NilError(t, os.MkdirAll(filepath.Dir(filename), 0o750))
 		// write content to filename
 		assert.NilError(t, os.WriteFile(filename, []byte(content), 0o600))
 	}