Fix CodeQL code scanning alerts

modules/charset/escape_stream.go

@@ -61,12 +61,14 @@ func (e *escapeStreamer) Text(data string) error {
 			until = len(data)
 			next = until
 		} else {
-			until, next = nextIdxs[0]+pos, nextIdxs[1]+pos
+			until = min(nextIdxs[0]+pos, len(data))
+			next = min(nextIdxs[1]+pos, len(data))
 		}
 
 		// from pos until we know that the runes are not \r\t\n or even ' '
-		runes := make([]rune, 0, next-until)
-		positions := make([]int, 0, next-until+1)
+		n := next - until
+		runes := make([]rune, 0, n)
+		positions := make([]int, 0, n+1)
 
 		for pos < until {
 			r, sz := utf8.DecodeRune(dataBytes[pos:])

modules/indexer/code/gitgrep/gitgrep.go

@@ -24,7 +24,7 @@ func indexSettingToGitGrepPathspecList() (list []string) {
 	return list
 }
 
-func PerformSearch(ctx context.Context, page int, repoID int64, gitRepo *git.Repository, ref git.RefName, keyword string, searchMode indexer.SearchModeType) (searchResults []*code_indexer.Result, total int, err error) {
+func PerformSearch(ctx context.Context, page int, repoID int64, gitRepo *git.Repository, ref git.RefName, keyword string, searchMode indexer.SearchModeType) (searchResults []*code_indexer.Result, total int64, err error) {
 	grepMode := git.GrepModeWords
 	switch searchMode {
 	case indexer.SearchModeExact:
@@ -47,7 +47,7 @@ func PerformSearch(ctx context.Context, page int, repoID int64, gitRepo *git.Rep
 		return nil, 0, fmt.Errorf("gitRepo.GetRefCommitID: %w", err)
 	}
 
-	total = len(res)
+	total = int64(len(res))
 	pageStart := min((page-1)*setting.UI.RepoSearchPagingNum, len(res))
 	pageEnd := min(page*setting.UI.RepoSearchPagingNum, len(res))
 	res = res[pageStart:pageEnd]

modules/indexer/code/search.go

@@ -130,7 +130,7 @@ func searchResult(result *internal.SearchResult, startIndex, endIndex int) (*Res
 }
 
 // PerformSearch perform a search on a repository
-func PerformSearch(ctx context.Context, opts *SearchOptions) (int, []*Result, []*SearchResultLanguages, error) {
+func PerformSearch(ctx context.Context, opts *SearchOptions) (int64, []*Result, []*SearchResultLanguages, error) {
 	if opts == nil || len(opts.Keyword) == 0 {
 		return 0, nil, nil, nil
 	}
@@ -149,5 +149,5 @@ func PerformSearch(ctx context.Context, opts *SearchOptions) (int, []*Result, []
 			return 0, nil, nil, err
 		}
 	}
-	return int(total), displayResults, resultLanguages, nil
+	return total, displayResults, resultLanguages, nil
 }

modules/templates/htmlrenderer.go

@@ -89,7 +89,7 @@ func (p *templateErrorPrettier) handleGenericTemplateError(err error) string {
 		return ""
 	}
 	tmplName, lineStr, message := groups[1], groups[2], groups[3]
-	return p.makeDetailedError(message, tmplName, lineStr, -1, "")
+	return p.makeDetailedError(message, tmplName, lineStr, "", "")
 }
 
 var reFuncNotDefinedError = regexp.MustCompile(`^template: (.*):([0-9]+): (function "(.*)" not defined)`)
@@ -101,7 +101,7 @@ func (p *templateErrorPrettier) handleFuncNotDefinedError(err error) string {
 	}
 	tmplName, lineStr, message, funcName := groups[1], groups[2], groups[3], groups[4]
 	funcName, _ = strconv.Unquote(`"` + funcName + `"`)
-	return p.makeDetailedError(message, tmplName, lineStr, -1, funcName)
+	return p.makeDetailedError(message, tmplName, lineStr, "", funcName)
 }
 
 var reUnexpectedOperandError = regexp.MustCompile(`^template: (.*):([0-9]+): (unexpected "(.*)" in operand)`)
@@ -113,7 +113,7 @@ func (p *templateErrorPrettier) handleUnexpectedOperandError(err error) string {
 	}
 	tmplName, lineStr, message, unexpected := groups[1], groups[2], groups[3], groups[4]
 	unexpected, _ = strconv.Unquote(`"` + unexpected + `"`)
-	return p.makeDetailedError(message, tmplName, lineStr, -1, unexpected)
+	return p.makeDetailedError(message, tmplName, lineStr, "", unexpected)
 }
 
 var reExpectedEndError = regexp.MustCompile(`^template: (.*):([0-9]+): (expected end; found (.*))`)
@@ -124,7 +124,7 @@ func (p *templateErrorPrettier) handleExpectedEndError(err error) string {
 		return ""
 	}
 	tmplName, lineStr, message, unexpected := groups[1], groups[2], groups[3], groups[4]
-	return p.makeDetailedError(message, tmplName, lineStr, -1, unexpected)
+	return p.makeDetailedError(message, tmplName, lineStr, "", unexpected)
 }
 
 var (
@@ -154,20 +154,20 @@ func HandleTemplateRenderingError(err error) string {
 
 const dashSeparator = "----------------------------------------------------------------------"
 
-func (p *templateErrorPrettier) makeDetailedError(errMsg, tmplName string, lineNum, posNum any, target string) string {
+func (p *templateErrorPrettier) makeDetailedError(errMsg, tmplName, lineNumStr, posNumStr, target string) string {
 	code, layer, err := p.assets.ReadLayeredFile(tmplName + ".tmpl")
 	if err != nil {
 		return fmt.Sprintf("template error: %s, and unable to find template file %q", errMsg, tmplName)
 	}
-	line, err := util.ToInt64(lineNum)
+	line, err := strconv.Atoi(lineNumStr)
 	if err != nil {
-		return fmt.Sprintf("template error: %s, unable to parse template %q line number %q", errMsg, tmplName, lineNum)
+		return fmt.Sprintf("template error: %s, unable to parse template %q line number %s", errMsg, tmplName, lineNumStr)
 	}
-	pos, err := util.ToInt64(posNum)
+	pos, err := strconv.Atoi(util.IfZero(posNumStr, "-1"))
 	if err != nil {
-		return fmt.Sprintf("template error: %s, unable to parse template %q pos number %q", errMsg, tmplName, posNum)
+		return fmt.Sprintf("template error: %s, unable to parse template %q pos number %s", errMsg, tmplName, posNumStr)
 	}
-	detail := extractErrorLine(code, int(line), int(pos), target)
+	detail := extractErrorLine(code, line, pos, target)
 
 	var msg string
 	if pos >= 0 {

routers/api/v1/admin/adopt.go

@@ -50,7 +50,7 @@ func ListUnadoptedRepositories(ctx *context.APIContext) {
 		return
 	}
 
-	ctx.SetTotalCountHeader(int64(count))
+	ctx.SetTotalCountHeader(count)
 
 	ctx.JSON(http.StatusOK, repoNames)
 }

routers/api/v1/admin/email.go

@@ -51,7 +51,7 @@ func GetAllEmails(ctx *context.APIContext) {
 		results[i] = convert.ToEmailSearch(emails[i])
 	}
 
-	ctx.SetLinkHeader(int(maxResults), listOptions.PageSize)
+	ctx.SetLinkHeader(maxResults, listOptions.PageSize)
 	ctx.SetTotalCountHeader(maxResults)
 	ctx.JSON(http.StatusOK, &results)
 }

routers/api/v1/admin/hooks.go

@@ -77,7 +77,7 @@ func ListHooks(ctx *context.APIContext) {
 		}
 		hooks[i] = h
 	}
-	ctx.SetLinkHeader(int(total), listOptions.PageSize)
+	ctx.SetLinkHeader(total, listOptions.PageSize)
 	ctx.SetTotalCountHeader(total)
 	ctx.JSON(http.StatusOK, hooks)
 }

routers/api/v1/admin/org.go

@@ -117,7 +117,7 @@ func GetAllOrgs(ctx *context.APIContext) {
 		orgs[i] = convert.ToOrganization(ctx, organization.OrgFromUser(users[i]))
 	}
 
-	ctx.SetLinkHeader(int(maxResults), listOptions.PageSize)
+	ctx.SetLinkHeader(maxResults, listOptions.PageSize)
 	ctx.SetTotalCountHeader(maxResults)
 	ctx.JSON(http.StatusOK, &orgs)
 }

routers/api/v1/admin/user.go

@@ -534,7 +534,7 @@ func SearchUsers(ctx *context.APIContext) {
 		results[i] = convert.ToUser(ctx, users[i], ctx.Doer)
 	}
 
-	ctx.SetLinkHeader(int(maxResults), listOptions.PageSize)
+	ctx.SetLinkHeader(maxResults, listOptions.PageSize)
 	ctx.SetTotalCountHeader(maxResults)
 	ctx.JSON(http.StatusOK, &results)
 }

routers/api/v1/notify/repo.go

@@ -125,7 +125,7 @@ func ListRepoNotifications(ctx *context.APIContext) {
 		return
 	}
 
-	ctx.SetLinkHeader(int(totalCount), opts.PageSize)
+	ctx.SetLinkHeader(totalCount, opts.PageSize)
 	ctx.SetTotalCountHeader(totalCount)
 	ctx.JSON(http.StatusOK, convert.ToNotifications(ctx, nl))
 }

routers/api/v1/notify/user.go

@@ -86,7 +86,7 @@ func ListNotifications(ctx *context.APIContext) {
 		return
 	}
 
-	ctx.SetLinkHeader(int(totalCount), opts.PageSize)
+	ctx.SetLinkHeader(totalCount, opts.PageSize)
 	ctx.SetTotalCountHeader(totalCount)
 	ctx.JSON(http.StatusOK, convert.ToNotifications(ctx, nl))
 }

routers/api/v1/org/action.go

@@ -67,7 +67,7 @@ func (Action) ListActionsSecrets(ctx *context.APIContext) {
 		}
 	}
 
-	ctx.SetLinkHeader(int(count), opts.PageSize)
+	ctx.SetLinkHeader(count, opts.PageSize)
 	ctx.SetTotalCountHeader(count)
 	ctx.JSON(http.StatusOK, apiSecrets)
 }
@@ -240,7 +240,7 @@ func (Action) ListVariables(ctx *context.APIContext) {
 			Description: v.Description,
 		}
 	}
-	ctx.SetLinkHeader(int(count), listOptions.PageSize)
+	ctx.SetLinkHeader(count, listOptions.PageSize)
 	ctx.SetTotalCountHeader(count)
 	ctx.JSON(http.StatusOK, variables)
 }

routers/api/v1/org/member.go

@@ -45,7 +45,7 @@ func listMembers(ctx *context.APIContext, isMember bool) {
 		apiMembers[i] = convert.ToUser(ctx, member, ctx.Doer)
 	}
 
-	ctx.SetLinkHeader(int(count), listOptions.PageSize)
+	ctx.SetLinkHeader(count, listOptions.PageSize)
 	ctx.SetTotalCountHeader(count)
 	ctx.JSON(http.StatusOK, apiMembers)
 }

routers/api/v1/org/org.go

@@ -42,7 +42,7 @@ func listUserOrgs(ctx *context.APIContext, u *user_model.User) {
 		apiOrgs[i] = convert.ToOrganization(ctx, orgs[i])
 	}
 
-	ctx.SetLinkHeader(int(maxResults), listOptions.PageSize)
+	ctx.SetLinkHeader(maxResults, listOptions.PageSize)
 	ctx.SetTotalCountHeader(maxResults)
 	ctx.JSON(http.StatusOK, &apiOrgs)
 }
@@ -215,7 +215,7 @@ func GetAll(ctx *context.APIContext) {
 		orgs[i] = convert.ToOrganization(ctx, organization.OrgFromUser(publicOrgs[i]))
 	}
 
-	ctx.SetLinkHeader(int(maxResults), listOptions.PageSize)
+	ctx.SetLinkHeader(maxResults, listOptions.PageSize)
 	ctx.SetTotalCountHeader(maxResults)
 	ctx.JSON(http.StatusOK, &orgs)
 }

routers/api/v1/org/team.go

@@ -70,7 +70,7 @@ func ListTeams(ctx *context.APIContext) {
 		return
 	}
 
-	ctx.SetLinkHeader(int(count), listOptions.PageSize)
+	ctx.SetLinkHeader(count, listOptions.PageSize)
 	ctx.SetTotalCountHeader(count)
 	ctx.JSON(http.StatusOK, apiTeams)
 }
@@ -111,7 +111,7 @@ func ListUserTeams(ctx *context.APIContext) {
 		return
 	}
 
-	ctx.SetLinkHeader(int(count), listOptions.PageSize)
+	ctx.SetLinkHeader(count, listOptions.PageSize)
 	ctx.SetTotalCountHeader(count)
 	ctx.JSON(http.StatusOK, apiTeams)
 }
@@ -411,7 +411,7 @@ func GetTeamMembers(ctx *context.APIContext) {
 		members[i] = convert.ToUser(ctx, member, ctx.Doer)
 	}
 
-	ctx.SetLinkHeader(ctx.Org.Team.NumMembers, listOptions.PageSize)
+	ctx.SetLinkHeader(int64(ctx.Org.Team.NumMembers), listOptions.PageSize)
 	ctx.SetTotalCountHeader(int64(ctx.Org.Team.NumMembers))
 	ctx.JSON(http.StatusOK, members)
 }
@@ -583,7 +583,7 @@ func GetTeamRepos(ctx *context.APIContext) {
 		}
 		repos[i] = convert.ToRepo(ctx, repo, permission)
 	}
-	ctx.SetLinkHeader(team.NumRepos, listOptions.PageSize)
+	ctx.SetLinkHeader(int64(team.NumRepos), listOptions.PageSize)
 	ctx.SetTotalCountHeader(int64(team.NumRepos))
 	ctx.JSON(http.StatusOK, repos)
 }
@@ -827,7 +827,7 @@ func SearchTeam(ctx *context.APIContext) {
 		return
 	}
 
-	ctx.SetLinkHeader(int(maxResults), listOptions.PageSize)
+	ctx.SetLinkHeader(maxResults, listOptions.PageSize)
 	ctx.SetTotalCountHeader(maxResults)
 	ctx.JSON(http.StatusOK, map[string]any{
 		"ok":   true,
@@ -882,7 +882,7 @@ func ListTeamActivityFeeds(ctx *context.APIContext) {
 		ctx.APIErrorInternal(err)
 		return
 	}
-	ctx.SetLinkHeader(int(count), listOptions.PageSize)
+	ctx.SetLinkHeader(count, listOptions.PageSize)
 	ctx.SetTotalCountHeader(count)
 	ctx.JSON(http.StatusOK, convert.ToActivities(ctx, feeds, ctx.Doer))
 }

routers/api/v1/packages/package.go

@@ -68,7 +68,7 @@ func ListPackages(ctx *context.APIContext) {
 		return
 	}
 
-	ctx.SetLinkHeader(int(count), listOptions.PageSize)
+	ctx.SetLinkHeader(count, listOptions.PageSize)
 	ctx.SetTotalCountHeader(count)
 	ctx.JSON(http.StatusOK, apiPackages)
 }
@@ -249,7 +249,7 @@ func ListPackageVersions(ctx *context.APIContext) {
 		return
 	}
 
-	ctx.SetLinkHeader(int(count), listOptions.PageSize)
+	ctx.SetLinkHeader(count, listOptions.PageSize)
 	ctx.SetTotalCountHeader(count)
 	ctx.JSON(http.StatusOK, apiPackages)
 }

routers/api/v1/repo/action.go

@@ -91,7 +91,7 @@ func (Action) ListActionsSecrets(ctx *context.APIContext) {
 			Created:     v.CreatedUnix.AsTime(),
 		}
 	}
-	ctx.SetLinkHeader(int(count), listOptions.PageSize)
+	ctx.SetLinkHeader(count, listOptions.PageSize)
 	ctx.SetTotalCountHeader(count)
 	ctx.JSON(http.StatusOK, apiSecrets)
 }
@@ -506,7 +506,7 @@ func (Action) ListVariables(ctx *context.APIContext) {
 		}
 	}
 
-	ctx.SetLinkHeader(int(count), listOptions.PageSize)
+	ctx.SetLinkHeader(count, listOptions.PageSize)
 	ctx.SetTotalCountHeader(count)
 	ctx.JSON(http.StatusOK, variables)
 }
@@ -811,7 +811,7 @@ func ListActionTasks(ctx *context.APIContext) {
 		res.Entries[i] = convertedTask
 	}
 
-	ctx.SetLinkHeader(int(total), listOptions.PageSize)
+	ctx.SetLinkHeader(total, listOptions.PageSize)
 	ctx.SetTotalCountHeader(total) // Duplicates api response field but it's better to set it for consistency
 	ctx.JSON(http.StatusOK, &res)
 }

routers/api/v1/repo/branch.go

@@ -375,7 +375,7 @@ func ListBranches(ctx *context.APIContext) {
 		}
 	}
 
-	ctx.SetLinkHeader(int(totalNumOfBranches), listOptions.PageSize)
+	ctx.SetLinkHeader(totalNumOfBranches, listOptions.PageSize)
 	ctx.SetTotalCountHeader(totalNumOfBranches)
 	ctx.JSON(http.StatusOK, apiBranches)
 }

routers/api/v1/repo/commits.go

@@ -290,7 +290,7 @@ func GetAllCommits(ctx *context.APIContext) {
 		}
 	}
 
-	ctx.SetLinkHeader(int(commitsCountTotal), listOptions.PageSize)
+	ctx.SetLinkHeader(commitsCountTotal, listOptions.PageSize)
 	ctx.SetTotalCountHeader(commitsCountTotal)
 
 	// kept for backwards compatibility

routers/api/v1/repo/issue.go

@@ -299,7 +299,7 @@ func SearchIssues(ctx *context.APIContext) {
 		return
 	}
 
-	ctx.SetLinkHeader(int(total), limit)
+	ctx.SetLinkHeader(total, limit)
 	ctx.SetTotalCountHeader(total)
 	ctx.JSON(http.StatusOK, convert.ToAPIIssueList(ctx, ctx.Doer, issues))
 }
@@ -527,7 +527,7 @@ func ListIssues(ctx *context.APIContext) {
 		return
 	}
 
-	ctx.SetLinkHeader(int(total), listOptions.PageSize)
+	ctx.SetLinkHeader(total, listOptions.PageSize)
 	ctx.SetTotalCountHeader(total)
 	ctx.JSON(http.StatusOK, convert.ToAPIIssueList(ctx, ctx.Doer, issues))
 }

routers/api/v1/repo/issue_dependency.go

@@ -81,7 +81,7 @@ func GetIssueDependencies(ctx *context.APIContext) {
 
 	canWrite := ctx.Repo.Permission.CanWriteIssuesOrPulls(issue.IsPull)
 
-	blockerIssues := make([]*issues_model.Issue, 0, listOptions.PageSize)
+	blockerIssues := make([]*issues_model.Issue, 0, min(listOptions.PageSize, setting.API.MaxResponseItems))
 
 	// 2. Get the issues this issue depends on, i.e. the `<#b>`: `<issue> <- <#b>`
 	blockersInfo, total, err := issue.BlockedByDependencies(ctx, listOptions)
@@ -140,7 +140,7 @@ func GetIssueDependencies(ctx *context.APIContext) {
 		}
 		blockerIssues = append(blockerIssues, &blocker.Issue)
 	}
-	ctx.SetLinkHeader(int(total), listOptions.PageSize)
+	ctx.SetLinkHeader(total, listOptions.PageSize)
 	ctx.SetTotalCountHeader(total)
 	ctx.JSON(http.StatusOK, convert.ToAPIIssueList(ctx, ctx.Doer, blockerIssues))
 }

routers/api/v1/repo/mirror.go

@@ -179,7 +179,7 @@ func ListPushMirrors(ctx *context.APIContext) {
 			responsePushMirrors = append(responsePushMirrors, m)
 		}
 	}
-	ctx.SetLinkHeader(len(responsePushMirrors), utils.GetListOptions(ctx).PageSize)
+	ctx.SetLinkHeader(int64(len(responsePushMirrors)), utils.GetListOptions(ctx).PageSize)
 	ctx.SetTotalCountHeader(count)
 	ctx.JSON(http.StatusOK, responsePushMirrors)
 }