fix(security): address critical vulnerabilities from code review

[cschuman]

Summary

Addresses all critical security vulnerabilities and code quality issues identified in the comprehensive code review.

Security Fixes (Critical)

Path Traversal Protection (CWE-22)

• Added validatePath() function in main.go
• Verifies paths are within current working directory
• Resolves symlinks to prevent TOCTOU attacks

Arbitrary File Write Protection (CWE-73)

• Added validatePathForWrite() in fixer/fixer.go
• Validates file is regular file (not device/socket)
• Checks path and symlink target are within CWD

Resource Exhaustion Prevention (CWE-400)

const (
    MaxFilesPerScan   = 10000
    MaxFileSizeBytes  = 10 * 1024 * 1024 // 10MB
    MaxDirectoryDepth = 50
)

Code Quality Fixes

Context Leak False Positives

Fixed detection to only track calls to known cancel functions from the cancelFuncs map, preventing false positives when other functions with matching names exist.

Shared Helpers Extraction

Created rules/helpers.go with shared functions:

• isHTTPHandler() - expanded to support Echo, Gin, Chi, Fiber frameworks
• estimateStructSizes()
• getTypeName()
• itoa()
• isInLoop()
• findFunctionContaining()

Fixer Cleanup

• Removed misleading AST modification code that set modified = true but never applied changes
• Fixed build error from redundant newline
• Added isValidIdentifier() for safe message extraction

Testing

Package	Before	After
fixer	0%	28.2%
rules	5.6%	14.8%

New Tests Added

• Context background in handler detection
• Context leak detection (including false positive prevention)
• HTTP handler detection for multiple frameworks
• Struct size estimation
• pprof in hot path detection
• Path validation security tests
• Identifier validation tests

All 50 tests pass.

Test Plan

• go build -o goperf . succeeds
• go test ./... passes (50 tests)
• Security validation rejects path traversal attempts
• Context leak detection no longer has false positives