fix: config validation (#527)

Signed-off-by: Chris Gianelloni <wolf31o2@blinklabs.io>

Author: wolf31o2

internal/config/config.go

@@ -17,6 +17,7 @@ package config
 import (
 	"errors"
 	"fmt"
+	"net/url"
 	"os"
 	"runtime"
 
@@ -138,6 +139,10 @@ func Load(configFile string) (*Config, error) {
 	if err := globalConfig.validateProfile(); err != nil {
 		return nil, err
 	}
+	// Validate submit config
+	if err := globalConfig.validateSubmit(); err != nil {
+		return nil, err
+	}
 	// Populate our Indexer startup
 	if err := globalConfig.populateIndexer(); err != nil {
 		return nil, err
@@ -173,6 +178,26 @@ func (c *Config) validateProfile() error {
 	return nil
 }
 
+func (c *Config) validateSubmit() error {
+	if c.Submit.Url == "" {
+		return nil
+	}
+	u, err := url.Parse(c.Submit.Url)
+	if err != nil {
+		return fmt.Errorf("invalid submit URL %q: %w", c.Submit.Url, err)
+	}
+	if u.Scheme != "http" && u.Scheme != "https" {
+		return fmt.Errorf(
+			"invalid submit URL scheme %q: must be http or https",
+			u.Scheme,
+		)
+	}
+	if u.Host == "" {
+		return fmt.Errorf("invalid submit URL %q: missing host", c.Submit.Url)
+	}
+	return nil
+}
+
 func (c *Config) populateIndexer() error {
 	profile, ok := Profiles[c.Network][c.Profile]
 	if !ok {

internal/tx/tx.go

@@ -539,7 +539,7 @@ func submitTxApi(txRawBytes []byte) (string, error) {
 		req.Header.Add("project_id", cfg.Submit.BlockFrostProjectID)
 	}
 	client := &http.Client{Timeout: 5 * time.Minute}
-	resp, err := client.Do(req) //nolint:gosec
+	resp, err := client.Do(req) //nolint:gosec // URL is validated at config load time
 	if err != nil {
 		return "", fmt.Errorf(
 			"failed to send request: %s: %w",
@@ -553,12 +553,12 @@ func submitTxApi(txRawBytes []byte) (string, error) {
 			cfg.Submit.Url,
 		)
 	}
+	defer resp.Body.Close()
 	// We have to read the entire response body and close it to prevent a memory leak
 	respBody, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return "", fmt.Errorf("failed to read response body: %w", err)
 	}
-	defer resp.Body.Close()
 
 	if resp.StatusCode == http.StatusAccepted {
 		return string(respBody), nil

internal/wallet/wallet.go

@@ -54,19 +54,19 @@ func Setup() {
 			}
 			// Write seed.txt
 			// WARNING: this will clobber existing files
-			f, err := os.Create(seedPath)
+			f, err := os.OpenFile(seedPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)
 			if err != nil {
 				panic(err)
 			}
 			l, err := f.WriteString(mnemonic)
-			slog.Debug( //nolint:gosec
-				"wrote seed file",
-				"bytes", l,
-			)
 			if err != nil {
 				f.Close()
 				panic(err)
 			}
+			slog.Debug( //nolint:gosec
+				"wrote seed file",
+				"bytes", l,
+			)
 			err = f.Close()
 			if err != nil {
 				panic(err)