fix(push): Broadcast shares one payload slice across dispatch goroutines — data race #109

New issue

Open

opened 2026-07-10 17:45:31 +02:00 by dominik.polakovics · 0 comments

dominik.polakovics commented

2026-07-10 17:45:31 +02:00

Owner

Found while landing PR #103 (out of scope for that change; internal/push is untouched by it — this is pre-existing #98 code).

Symptom

go test -race ./internal/push/ fails on main.

Repro:

go test -race -run TestBroadcastHappyPath ./internal/push/

Root cause

Sender.Broadcast marshals the payload once and hands the same []byte to every dispatch goroutine (internal/push/sender.go ~L103-113). webpush-go v1.4.0 then does bytes.NewBuffer(message) and appends padding into the slice's spare capacity (webpush.go ~L179-186). Since json.Marshal routinely returns a slice with cap > len, N subscriptions means N goroutines writing into the same backing array concurrently.

Fix

Give each dispatch its own copy of the bytes, e.g.:

s.dispatch(sub, bytes.Clone(body))

One line; a -race test over a multi-subscription broadcast should regress it.

Found while landing PR #103 (out of scope for that change; `internal/push` is untouched by it — this is pre-existing #98 code). ## Symptom `go test -race ./internal/push/` fails on `main`. Repro: go test -race -run TestBroadcastHappyPath ./internal/push/ ## Root cause `Sender.Broadcast` marshals the payload once and hands the **same** `[]byte` to every dispatch goroutine (`internal/push/sender.go` ~L103-113). webpush-go v1.4.0 then does `bytes.NewBuffer(message)` and **appends padding into the slice's spare capacity** (`webpush.go` ~L179-186). Since `json.Marshal` routinely returns a slice with `cap > len`, N subscriptions means N goroutines writing into the same backing array concurrently. ## Fix Give each dispatch its own copy of the bytes, e.g.: s.dispatch(sub, bytes.Clone(body)) One line; a `-race` test over a multi-subscription broadcast should regress it.

dominik.polakovics added the

needs-triage

bug

labels

2026-07-10 17:45:31 +02:00

dominik.polakovics referenced this issue

2026-07-10 18:23:00 +02:00

feat(notify): done-signal trigger — notify when an AFK run opens its PR/change request #100

dominik.polakovics referenced this issue

2026-07-10 18:52:36 +02:00

feat(secrets): exposure detection — exposed flag, chat badge, mask-on-render #108