[GH-ISSUE #161] Audit: Avoid http.DefaultClient in upload operations #45

New issue

Closed

opened 2026-02-26 21:32:58 +03:00 by kerem · 1 comment

kerem commented

2026-02-26 21:32:58 +03:00

Owner

Originally created by @rudrankriyam on GitHub (Jan 25, 2026).
Original GitHub issue: https://github.com/rudrankriyam/App-Store-Connect-CLI/issues/161

Description

internal/asc/upload.go:58 uses http.DefaultClient for upload operations:

uploadOpts := UploadOptions{
    Client: http.DefaultClient,  // SHARES CONNECTION POOL
    ...
}

Impact

http.DefaultClient shares its Transport with all users of the package
Can cause connection pool exhaustion if used concurrently
Unexpected timeout/behavior changes affecting other code
Upload operations may inherit inappropriate default timeouts

Location

internal/asc/upload.go:58

Fix

Create a dedicated http.Client with appropriate timeouts, similar to how NewClient does it in client_core.go:310.

Severity

Critical

Originally created by @rudrankriyam on GitHub (Jan 25, 2026). Original GitHub issue: https://github.com/rudrankriyam/App-Store-Connect-CLI/issues/161 ## Description `internal/asc/upload.go:58` uses `http.DefaultClient` for upload operations: ```go uploadOpts := UploadOptions{ Client: http.DefaultClient, // SHARES CONNECTION POOL ... } ``` ## Impact - `http.DefaultClient` shares its Transport with all users of the package - Can cause connection pool exhaustion if used concurrently - Unexpected timeout/behavior changes affecting other code - Upload operations may inherit inappropriate default timeouts ## Location `internal/asc/upload.go:58` ## Fix Create a dedicated `http.Client` with appropriate timeouts, similar to how `NewClient` does it in `client_core.go:310`. ## Severity Critical