internal/normalize: harden against possible attacks; optimize registry

Signed-off-by: NotAShelf <raf@notashelf.dev>
Change-Id: Iaf89cda3c480d6a8371e5f146ee95fcf6a6a6964

internal/normalize/referrer_registry.go

@@ -17,16 +17,26 @@ func NewReferrerRegistry(maxSources int) *ReferrerRegistry {
 	}
 }
 
-// Attempt to add a referrer source to the registry. Returns the source to use ("other" if rejected).
+// Attempt to add a referrer source to the registry.
+// Returns the source to use ("other" if rejected).
 func (r *ReferrerRegistry) Add(source string) string {
 	if source == "direct" || source == "internal" {
 		return source
 	}
 
+	// Fast path: check with read lock first
+	r.mu.RLock()
+	if _, exists := r.sources[source]; exists {
+		r.mu.RUnlock()
+		return source
+	}
+	r.mu.RUnlock()
+
+	// Slow path: acquire write lock to add
 	r.mu.Lock()
 	defer r.mu.Unlock()
 
-	// Already exists
+	// Double-check after acquiring write lock, another goroutine might have added it beforehand
 	if _, exists := r.sources[source]; exists {
 		return source
 	}