Harden popular links period handling

Author: dfcarney

db.go

@@ -84,6 +84,8 @@ func (s *SQLiteDB) LoadAll() ([]*Link, error) {
 	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
+
 	for rows.Next() {
 		link := new(Link)
 		var created, lastEdit int64
@@ -178,6 +180,8 @@ func (s *SQLiteDB) LoadStats() (ClickStats, error) {
 	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
+
 	stats := make(map[string]int)
 	for rows.Next() {
 		var id string
@@ -266,6 +270,8 @@ func (s *SQLiteDB) GetLinksByOwner(owner string) ([]*Link, error) {
 	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
+
 	for rows.Next() {
 		link := new(Link)
 		var created, lastEdit int64

golink.go

@@ -44,6 +44,7 @@ import (
 
 const (
 	defaultHostname = "go"
+	maxStatsPeriod  = 365 * 24 * time.Hour
 
 	// Used as a placeholder short name for generating the XSRF defense token,
 	// when creating new links.
@@ -580,12 +581,12 @@ func parseStatsPeriod(period string) (time.Duration, bool) {
 	if period == "" {
 		return 0, false
 	}
-	if d, err := time.ParseDuration(period); err == nil && d > 0 {
+	if d, err := time.ParseDuration(period); err == nil && d > 0 && d <= maxStatsPeriod {
 		return d, true
 	}
 	if days, ok := strings.CutSuffix(period, "d"); ok {
 		n, err := strconv.Atoi(days)
-		if err == nil && n > 0 {
+		if err == nil && n > 0 && n <= int(maxStatsPeriod/(24*time.Hour)) {
 			return time.Duration(n) * 24 * time.Hour, true
 		}
 	}

golink_test.go

@@ -973,10 +973,28 @@ func TestParseStatsPeriod(t *testing.T) {
 			want:   168 * time.Hour,
 			wantOK: true,
 		},
+		{
+			name:   "max duration",
+			period: "8760h",
+			want:   maxStatsPeriod,
+			wantOK: true,
+		},
+		{
+			name:   "too long duration",
+			period: "8761h",
+		},
+		{
+			name:   "too many days",
+			period: "366d",
+		},
 		{
 			name:   "negative",
 			period: "-7d",
 		},
+		{
+			name:   "overflowing days",
+			period: "100000000000000000000d",
+		},
 		{
 			name:   "invalid",
 			period: "nope",