From e3d35cb22b01fb13da2647b3147862b731b105d8 Mon Sep 17 00:00:00 2001
From: djshow832 <zhangming@pingcap.com>
Date: Mon, 5 Aug 2024 15:27:41 +0800
Subject: [PATCH] backend, cli: fix vulnerability issues scanned by third-party
 tools (#623)

---
 lib/cli/util.go                       | 5 ++---
 pkg/proxy/backend/backend_conn_mgr.go | 7 +++----
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/lib/cli/util.go b/lib/cli/util.go
index 3ac02fa6..3d86207b 100644
--- a/lib/cli/util.go
+++ b/lib/cli/util.go
@@ -7,7 +7,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"math/rand"
 	"net/http"
 
 	"github.com/pingcap/tiproxy/lib/util/errors"
@@ -39,8 +38,8 @@ func doRequest(ctx context.Context, bctx *Context, method string, url string, rd
 
 	var rete string
 	var res *http.Response
-	for _, i := range rand.Perm(len(bctx.CUrls)) {
-		req.URL.Host = bctx.CUrls[i]
+	for _, url := range bctx.CUrls {
+		req.URL.Host = url
 
 		res, err = bctx.Client.Do(req)
 		if err != nil {
diff --git a/pkg/proxy/backend/backend_conn_mgr.go b/pkg/proxy/backend/backend_conn_mgr.go
index 38d3d63f..f4b5343e 100644
--- a/pkg/proxy/backend/backend_conn_mgr.go
+++ b/pkg/proxy/backend/backend_conn_mgr.go
@@ -15,7 +15,6 @@ import (
 	"sync"
 	"sync/atomic"
 	"time"
-	"unsafe"
 
 	"github.com/cenkalti/backoff/v4"
 	"github.com/go-mysql-org/go-mysql/mysql"
@@ -123,7 +122,7 @@ type BackendConnManager struct {
 	signalReceived chan signalType
 	authenticator  *Authenticator
 	cmdProcessor   *CmdProcessor
-	eventReceiver  unsafe.Pointer
+	eventReceiver  atomic.Pointer[router.ConnEventReceiver]
 	config         *BCConfig
 	logger         *zap.Logger
 	curBackend     router.BackendInst
@@ -406,11 +405,11 @@ func (mgr *BackendConnManager) updateTraffic(backendIO *pnet.PacketIO) {
 // SetEventReceiver implements RedirectableConn.SetEventReceiver interface.
 // The receiver sends redirection signals and watches redirecting events.
 func (mgr *BackendConnManager) SetEventReceiver(receiver router.ConnEventReceiver) {
-	atomic.StorePointer(&mgr.eventReceiver, unsafe.Pointer(&receiver))
+	mgr.eventReceiver.Store(&receiver)
 }
 
 func (mgr *BackendConnManager) getEventReceiver() router.ConnEventReceiver {
-	eventReceiver := (*router.ConnEventReceiver)(atomic.LoadPointer(&mgr.eventReceiver))
+	eventReceiver := mgr.eventReceiver.Load()
 	if eventReceiver == nil {
 		return nil
 	}