From f24b0b97e0e44c1b67ce13645d57b67c51846963 Mon Sep 17 00:00:00 2001
From: Viet Dinh <54ckb0y789@gmail.com>
Date: Wed, 12 Aug 2026 22:22:43 -0700
Subject: [PATCH] Fix bounds checking on counter, push notifs timeout

---
 server/notifications.go     | 9 ++++++---
 server/security/security.go | 2 +-
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/server/notifications.go b/server/notifications.go
index b6f3a6d..49d3476 100644
--- a/server/notifications.go
+++ b/server/notifications.go
@@ -181,6 +181,9 @@ func sendPushNotification(notification *Notification, uuids []string) error {
 			VAPIDPublicKey:  config.vapidKeys.public,
 			VAPIDPrivateKey: config.vapidKeys.private,
 			TTL:             30, // seconds,
+			HTTPClient: &http.Client{
+				Timeout: 10 * time.Second,
+			},
 		})
 		if err != nil {
 			log.Printf("error sending notifications: %s", err)
@@ -196,11 +199,11 @@ func sendPushNotification(notification *Notification, uuids []string) error {
 	return errors.Join(failures...)
 }
 
-func getPlaceholders(values ...string) (placeholders string, parameters []interface{}) {
+func getPlaceholders(values ...string) (placeholders string, parameters []any) {
 	n := len(values)
 	p := make([]string, n)
-	parameters = make([]interface{}, n)
-	for i := 0; i < n; i++ {
+	parameters = make([]any, n)
+	for i := range n {
 		p[i] = "?"
 		parameters[i] = values[i]
 	}
diff --git a/server/security/security.go b/server/security/security.go
index 921f3b5..2be6bed 100644
--- a/server/security/security.go
+++ b/server/security/security.go
@@ -57,7 +57,7 @@ func (s *Security) VerifySignature(clientKey uint32, msg []byte) bool {
 }
 
 func (s *Security) VerifyCounter(counter *uint32, msg []byte) bool {
-	if cnt := binary.BigEndian.Uint32(msg[4 : len(msg)-4]); *counter < cnt {
+	if cnt := binary.BigEndian.Uint32(msg[4:]); *counter < cnt {
 		*counter = cnt
 		return true
 	}