fixed errors identified by gosec

internal/cache/helpers.go

@@ -35,7 +35,10 @@ func downloadToDisk(url, destPath string, c http.Client) error {
 	defer resp.Body.Close()
 
 	// make sure the dir structure exists
-	os.MkdirAll(filepath.Dir(destPath), 0755)
+	err = os.MkdirAll(filepath.Dir(destPath), 0750)
+	if err != nil {
+		return err
+	}
 
 	// use a tmp file for the initial fetch in case it fails
 	tempPath := destPath + ".tmp"
@@ -47,13 +50,19 @@ func downloadToDisk(url, destPath string, c http.Client) error {
 
 	_, err = io.Copy(tmpFile, resp.Body)
 	if err != nil {
-		os.Remove(tempPath)
+		removeErr := os.Remove(tempPath)
+		if removeErr != nil {
+			slog.Warn("failed to remove temp file", "path", tempPath, "err", removeErr)
+		}
 		return err
 	}
 
 	// mv file to final location
 	if err := os.Rename(tempPath, destPath); err != nil {
-		os.Remove(tempPath)
+		removeErr := os.Remove(tempPath)
+		if removeErr != nil {
+			slog.Warn("failed to remove temp file", "path", tempPath, "err", removeErr)
+		}
 		return err
 	}
 	return nil

main.go

@@ -6,6 +6,7 @@ import (
 	"log/slog"
 	"net/http"
 	"os"
+	"time"
 
 	"github.com/ewpt3ch/pkgstash/internal/cache"
 )
@@ -67,6 +68,7 @@ func main() {
 	httpServe := &http.Server{
 		Addr:              ":" + srv.cfg.Port,
 		Handler:           mux,
+		ReadHeaderTimeout: 5 * time.Second,
 	}
 
 	slog.Info("serving pkgstash", "root", cfg.CacheRoot, "port", cfg.Port)

response_helpers.go

@@ -21,5 +21,5 @@ func respondWithJSON(w http.ResponseWriter, code int, payload any) {
 	}
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(code)
-	w.Write(dat)
+	_, _ = w.Write(dat)
 }