[GH-ISSUE #163] Audit: Add empty path validation to config functions #44

New issue

Closed

opened 2026-02-26 21:32:58 +03:00 by kerem · 1 comment

kerem commented

2026-02-26 21:32:58 +03:00

Owner

Originally created by @rudrankriyam on GitHub (Jan 25, 2026).
Original GitHub issue: https://github.com/rudrankriyam/App-Store-Connect-CLI/issues/163

Description

LoadAt validates for empty paths, but SaveAt and RemoveAt in internal/config/config.go do not.

Impact

Inconsistent API behavior
Potential silent failures or unexpected errors

Location

internal/config/config.go:198 - SaveAt missing validation
internal/config/config.go:221 - RemoveAt missing validation

Fix

Add the same validation to SaveAt and RemoveAt:

func SaveAt(path string, cfg *Config) error {
    if strings.TrimSpace(path) == "" {
        return fmt.Errorf("failed to save config: empty path")
    }
    // ...
}

func RemoveAt(path string) error {
    if strings.TrimSpace(path) == "" {
        return fmt.Errorf("failed to remove config: empty path")
    }
    // ...
}

Severity

High

Originally created by @rudrankriyam on GitHub (Jan 25, 2026). Original GitHub issue: https://github.com/rudrankriyam/App-Store-Connect-CLI/issues/163 ## Description `LoadAt` validates for empty paths, but `SaveAt` and `RemoveAt` in `internal/config/config.go` do not. ## Impact - Inconsistent API behavior - Potential silent failures or unexpected errors ## Location - `internal/config/config.go:198` - `SaveAt` missing validation - `internal/config/config.go:221` - `RemoveAt` missing validation ## Fix Add the same validation to `SaveAt` and `RemoveAt`: ```go func SaveAt(path string, cfg *Config) error { if strings.TrimSpace(path) == "" { return fmt.Errorf("failed to save config: empty path") } // ... } func RemoveAt(path string) error { if strings.TrimSpace(path) == "" { return fmt.Errorf("failed to remove config: empty path") } // ... } ``` ## Severity High