fix(lint): G703/G704/G705 annotate taint analysis false positives with justifications
- commit
- bc5b3f7cc7956f071917a51631bdafcd5aa4b67e
- author
- bnema · · 2026-02-25 02:06 UTC
- parent
- b5f59d8
- signature
- unsigned
4 files · +6 -5
M internal/adapters/in/cli/remote/client.go +1 -1
| @@ -914,7 +914,7 @@ func (c *Client) streamLogs(ctx context.Context, path string) (<-chan string, er | |||
| 914 | 914 | streamClient := &http.Client{ | |
| 915 | 915 | Transport: c.httpClient.Transport, | |
| 916 | 916 | } | |
| 917 | - | resp, err := streamClient.Do(req) | |
| 917 | + | resp, err := streamClient.Do(req) //nolint:gosec // G704: CLI outbound request to user-configured remote, not server-side SSRF | |
| 918 | 918 | if err != nil { | |
| 919 | 919 | return nil, fmt.Errorf("failed to connect: %w", err) | |
| 920 | 920 | } | |
| @@ -914,7 +914,7 @@ func (c *Client) streamLogs(ctx context.Context, path string) (<-chan string, er | |||||
| 914 | streamClient := &http.Client{ | 914 | streamClient := &http.Client{ | ||
| 915 | Transport: c.httpClient.Transport, | 915 | Transport: c.httpClient.Transport, | ||
| 916 | } | 916 | } | ||
| 917 | - | resp, err := streamClient.Do(req) | 917 | + | resp, err := streamClient.Do(req) //nolint:gosec // G704: CLI outbound request to user-configured remote, not server-side SSRF |
| 918 | if err != nil { | 918 | if err != nil { | ||
| 919 | return nil, fmt.Errorf("failed to connect: %w", err) | 919 | return nil, fmt.Errorf("failed to connect: %w", err) | ||
| 920 | } | 920 | } | ||
M internal/adapters/in/http/registry/handler.go +2 -1
| @@ -279,10 +279,11 @@ func (h *Handler) handleGetManifest(w http.ResponseWriter, r *http.Request) { | |||
| 279 | 279 | ||
| 280 | 280 | w.Header().Set("Content-Type", manifestData.ContentType) | |
| 281 | 281 | w.Header().Set("Content-Length", strconv.Itoa(len(manifestData.Data))) | |
| 282 | + | w.Header().Set("X-Content-Type-Options", "nosniff") | |
| 282 | 283 | w.WriteHeader(http.StatusOK) | |
| 283 | 284 | ||
| 284 | 285 | if r.Method == "GET" { | |
| 285 | - | _, _ = w.Write(manifestData.Data) | |
| 286 | + | _, _ = w.Write(manifestData.Data) //nolint:gosec // G705: OCI manifest bytes with explicit media type header, not HTML content | |
| 286 | 287 | } | |
| 287 | 288 | } | |
| 288 | 289 | ||
| @@ -279,10 +279,11 @@ func (h *Handler) handleGetManifest(w http.ResponseWriter, r *http.Request) { | |||||
| 279 | 279 | ||||
| 280 | w.Header().Set("Content-Type", manifestData.ContentType) | 280 | w.Header().Set("Content-Type", manifestData.ContentType) | ||
| 281 | w.Header().Set("Content-Length", strconv.Itoa(len(manifestData.Data))) | 281 | w.Header().Set("Content-Length", strconv.Itoa(len(manifestData.Data))) | ||
| 282 | + | w.Header().Set("X-Content-Type-Options", "nosniff") | |||
| 282 | w.WriteHeader(http.StatusOK) | 283 | w.WriteHeader(http.StatusOK) | ||
| 283 | 284 | ||||
| 284 | if r.Method == "GET" { | 285 | if r.Method == "GET" { | ||
| 285 | - | _, _ = w.Write(manifestData.Data) | 286 | + | _, _ = w.Write(manifestData.Data) //nolint:gosec // G705: OCI manifest bytes with explicit media type header, not HTML content |
| 286 | } | 287 | } | ||
| 287 | } | 288 | } | ||
| 288 | 289 | ||||
M internal/adapters/out/httpprober/prober.go +1 -1
| @@ -79,7 +79,7 @@ func (p *Prober) Probe(ctx context.Context, url string) (int, int64, error) { | |||
| 79 | 79 | // Set a reasonable user agent | |
| 80 | 80 | req.Header.Set("User-Agent", "Gordon-HealthCheck/1.0") | |
| 81 | 81 | ||
| 82 | - | resp, err := p.client.Do(req) | |
| 82 | + | resp, err := p.client.Do(req) //nolint:gosec // G704: probe URL sourced from route configuration, not from user HTTP request | |
| 83 | 83 | if err != nil { | |
| 84 | 84 | elapsed := time.Since(start).Milliseconds() | |
| 85 | 85 | return 0, elapsed, fmt.Errorf("request failed: %w", err) | |
| @@ -79,7 +79,7 @@ func (p *Prober) Probe(ctx context.Context, url string) (int, int64, error) { | |||||
| 79 | // Set a reasonable user agent | 79 | // Set a reasonable user agent | ||
| 80 | req.Header.Set("User-Agent", "Gordon-HealthCheck/1.0") | 80 | req.Header.Set("User-Agent", "Gordon-HealthCheck/1.0") | ||
| 81 | 81 | ||||
| 82 | - | resp, err := p.client.Do(req) | 82 | + | resp, err := p.client.Do(req) //nolint:gosec // G704: probe URL sourced from route configuration, not from user HTTP request |
| 83 | if err != nil { | 83 | if err != nil { | ||
| 84 | elapsed := time.Since(start).Milliseconds() | 84 | elapsed := time.Since(start).Milliseconds() | ||
| 85 | return 0, elapsed, fmt.Errorf("request failed: %w", err) | 85 | return 0, elapsed, fmt.Errorf("request failed: %w", err) | ||
M internal/usecase/proxy/service.go +2 -2
| @@ -551,7 +551,7 @@ func (s *Service) proxyToTarget(w http.ResponseWriter, r *http.Request, target * | |||
| 551 | 551 | Str(zerowrap.FieldEntityID, target.ContainerID). | |
| 552 | 552 | Msg("proxying request") | |
| 553 | 553 | ||
| 554 | - | proxy.ServeHTTP(w, r) | |
| 554 | + | proxy.ServeHTTP(w, r) //nolint:gosec // G704: proxy target resolved from validated route config, not from incoming request | |
| 555 | 555 | } | |
| 556 | 556 | ||
| 557 | 557 | func (s *Service) trackInFlight(containerID string) func() { | |
| @@ -630,7 +630,7 @@ func (s *Service) proxyToRegistry(w http.ResponseWriter, r *http.Request) { | |||
| 630 | 630 | ||
| 631 | 631 | log.Debug().Str("target", targetURL.String()).Msg("proxying request to registry") | |
| 632 | 632 | ||
| 633 | - | proxy.ServeHTTP(w, r) | |
| 633 | + | proxy.ServeHTTP(w, r) //nolint:gosec // G704: proxy target resolved from validated route config, not from incoming request | |
| 634 | 634 | } | |
| 635 | 635 | ||
| 636 | 636 | func (s *Service) isRunningInContainer() bool { | |
| @@ -551,7 +551,7 @@ func (s *Service) proxyToTarget(w http.ResponseWriter, r *http.Request, target * | |||||
| 551 | Str(zerowrap.FieldEntityID, target.ContainerID). | 551 | Str(zerowrap.FieldEntityID, target.ContainerID). | ||
| 552 | Msg("proxying request") | 552 | Msg("proxying request") | ||
| 553 | 553 | ||||
| 554 | - | proxy.ServeHTTP(w, r) | 554 | + | proxy.ServeHTTP(w, r) //nolint:gosec // G704: proxy target resolved from validated route config, not from incoming request |
| 555 | } | 555 | } | ||
| 556 | 556 | ||||
| 557 | func (s *Service) trackInFlight(containerID string) func() { | 557 | func (s *Service) trackInFlight(containerID string) func() { | ||
| @@ -630,7 +630,7 @@ func (s *Service) proxyToRegistry(w http.ResponseWriter, r *http.Request) { | |||||
| 630 | 630 | ||||
| 631 | log.Debug().Str("target", targetURL.String()).Msg("proxying request to registry") | 631 | log.Debug().Str("target", targetURL.String()).Msg("proxying request to registry") | ||
| 632 | 632 | ||||
| 633 | - | proxy.ServeHTTP(w, r) | 633 | + | proxy.ServeHTTP(w, r) //nolint:gosec // G704: proxy target resolved from validated route config, not from incoming request |
| 634 | } | 634 | } | ||
| 635 | 635 | ||||
| 636 | func (s *Service) isRunningInContainer() bool { | 636 | func (s *Service) isRunningInContainer() bool { | ||