fix: address clawpatch security and reliability findings

Makefile

@@ -29,7 +29,10 @@ ifdef OUTPUT
   PHASHER_OUTPUT := $(OUTPUT)
 endif
 ifdef STASH_OUTPUT
+  STASH_BINARY := $(STASH_OUTPUT)
   STASH_OUTPUT := -o $(STASH_OUTPUT)
+else
+  STASH_BINARY := stash
 endif
 ifdef PHASHER_OUTPUT
   PHASHER_OUTPUT := -o $(PHASHER_OUTPUT)
@@ -446,8 +449,8 @@ remove-compiler-container:
 install: build-release
 ifdef IS_WIN_SHELL
 	@if not exist "$(PREFIX)" mkdir $(PREFIX)
-	@copy "dist\\stash-win.exe" "$(PREFIX)\\stash-win.exe"
+	@copy "$(STASH_BINARY).exe" "$(PREFIX)\\stash.exe"
 else
 	@mkdir -p $(PREFIX)/bin
-	@install -m 755 $(STASH_OUTPUT) $(PREFIX)/bin/stash
+	@install -m 755 $(STASH_BINARY) $(PREFIX)/bin/stash
 endif

cmd/phasher/main.go

@@ -23,6 +23,9 @@ func customUsage() {
 func printPhash(ff *ffmpeg.FFMpeg, ffp *ffmpeg.FFProbe, inputfile string, quiet *bool) error {
 	// Determine if this is a video or image file based on extension
 	ext := filepath.Ext(inputfile)
+	if ext == "" {
+		return fmt.Errorf("file %q has no extension, cannot determine type", inputfile)
+	}
 	ext = ext[1:] // remove the leading dot
 
 	// Common image extensions
@@ -119,10 +122,13 @@ func main() {
 	// don't need to InitHWSupport, phashing doesn't use hw acceleration
 	ffprobe := ffmpeg.NewFFProbe(ffprobePath)
 
+	exitCode := 0
 	for _, item := range args {
 		if err := printPhash(encoder, ffprobe, item, quiet); err != nil {
 			fmt.Fprintln(os.Stderr, err)
+			exitCode = 1
 		}
 	}
 
+	os.Exit(exitCode)
 }

cmd/stash/main.go

@@ -69,10 +69,12 @@ func main() {
 	l := initLog(cfg)
 
 	if cpuProfilePath != "" {
-		if err := initProfiling(cpuProfilePath); err != nil {
+		f, err := initProfiling(cpuProfilePath)
+		if err != nil {
 			exitError(err)
 			return
 		}
+		defer f.Close()
 		defer pprof.StopCPUProfile()
 	}
 
@@ -128,19 +130,20 @@ func initLog(cfg *config.Config) *log.Logger {
 	return l
 }
 
-func initProfiling(path string) error {
+func initProfiling(path string) (*os.File, error) {
 	f, err := os.Create(path)
 	if err != nil {
-		return fmt.Errorf("unable to create CPU profile file: %v", err)
+		return nil, fmt.Errorf("unable to create CPU profile file: %v", err)
 	}
 
 	if err = pprof.StartCPUProfile(f); err != nil {
-		return fmt.Errorf("could not start CPU profiling: %v", err)
+		f.Close()
+		return nil, fmt.Errorf("could not start CPU profiling: %v", err)
 	}
 
 	logger.Infof("profiling to %s", path)
 
-	return nil
+	return f, nil
 }
 
 func recoverPanic() {

cmd/stash/main_test.go

@@ -1,7 +1,64 @@
 package main
 
-import "testing"
+import (
+	"os"
+	"testing"
 
-func TestStub(t *testing.T) {
+	"github.com/stashapp/stash/internal/log"
+	"github.com/stashapp/stash/pkg/logger"
+)
 
+func TestExitError(t *testing.T) {
+	origCode := exitCode
+	origLogger := logger.Logger
+	defer func() {
+		exitCode = origCode
+		logger.Logger = origLogger
+	}()
+
+	l := log.NewLogger()
+	l.Init("", true, "Error", 0)
+	logger.Logger = l
+
+	exitCode = 0
+	exitError(os.ErrInvalid)
+	if exitCode != 1 {
+		t.Errorf("exitError should set exitCode to 1, got %d", exitCode)
+	}
+}
+
+func TestRecoverPanic(t *testing.T) {
+	origCode := exitCode
+	origLogger := logger.Logger
+	defer func() {
+		exitCode = origCode
+		logger.Logger = origLogger
+	}()
+
+	l := log.NewLogger()
+	l.Init("", true, "Error", 0)
+	logger.Logger = l
+
+	exitCode = 0
+	func() {
+		defer recoverPanic()
+		panic("test panic")
+	}()
+	if exitCode != 1 {
+		t.Errorf("recoverPanic should set exitCode to 1 after a panic, got %d", exitCode)
+	}
+}
+
+func TestInitLogTemp(t *testing.T) {
+	origLogger := logger.Logger
+	defer func() { logger.Logger = origLogger }()
+
+	logger.Logger = nil
+	l := initLogTemp()
+	if l == nil {
+		t.Fatal("initLogTemp should return a non-nil logger")
+	}
+	if logger.Logger == nil {
+		t.Error("initLogTemp should set the global logger.Logger")
+	}
 }

internal/api/models.go

@@ -44,7 +44,7 @@ func convertBaseFile(f models.File) BaseFile {
 		// assume gallery file if it's not a video or image file
 		return &GalleryFile{BaseFile: f}
 	default:
-		panic("unknown file type")
+		panic(fmt.Errorf("unknown file type %T", f))
 	}
 }
 

internal/api/resolver_query_find_file.go

@@ -103,9 +103,11 @@ func (r *queryResolver) FindFiles(
 			return err
 		}
 
+		convertedFiles := convertBaseFiles(files)
+
 		ret = &FindFilesResultType{
 			Count:      result.Count,
-			Files:      convertBaseFiles(files),
+			Files:      convertedFiles,
 			Duration:   result.TotalDuration,
 			Megapixels: result.Megapixels,
 			Size:       int(result.TotalSize),