Fix all gosec linter warnings (#43)

JamieMagee · web-flow · commit 2308f4ce9921 · 2026-02-10T22:54:19.000Z
diff --git a/internal/apiclient/client_test.go b/internal/apiclient/client_test.go
@@ -25,7 +25,7 @@ import (
 
 const (
 	jobID    = "1234"
-	jobToken = "hey-dependabot-api-its-me-ur-brother"
+	jobToken = "hey-dependabot-api-its-me-ur-brother" //nolint:gosec // test credential
 )
 
 func TestClient_ReportMetrics_Success(t *testing.T) {
diff --git a/internal/cache/handlers.go b/internal/cache/handlers.go
@@ -125,7 +125,7 @@ func New(enabled bool, cacheDir string) (*DB, error) {
 	if !enabled {
 		return nil, nil
 	}
-	if err := os.Mkdir(cacheDir, 0755); err != nil && !os.IsExist(err) {
+	if err := os.Mkdir(cacheDir, 0750); err != nil && !os.IsExist(err) {
 		cacheDir = filepath.Join(os.TempDir(), "cache")
 	}
 	db := &DB{
@@ -134,7 +134,7 @@ func New(enabled bool, cacheDir string) (*DB, error) {
 	}
 
 	// attempt to load pre-existing DB
-	f, err := os.Open(filepath.Join(cacheDir, "db.yaml"))
+	f, err := os.Open(filepath.Clean(filepath.Join(cacheDir, "db.yaml")))
 	if err != nil {
 		return db, nil
 	}
@@ -225,7 +225,7 @@ func (d *DB) OnResponse(resp *http.Response, ctx *goproxy.ProxyCtx) *http.Respon
 	}
 
 	fileName := fmt.Sprintf("%06d-%v", d.nextNumber(), sanitize(resp.Request.Host))
-	f, err := os.Create(filepath.Join(d.cacheDir, fileName))
+	f, err := os.Create(filepath.Clean(filepath.Join(d.cacheDir, fileName)))
 	if err != nil {
 		logrus.Warnln("Failed to write to cache:", err.Error())
 		return resp
@@ -276,7 +276,7 @@ func (d *DB) WriteToDisk() error {
 	d.Lock()
 	defer d.Unlock()
 
-	f, err := os.Create(filepath.Join(d.cacheDir, "db.yaml"))
+	f, err := os.Create(filepath.Clean(filepath.Join(d.cacheDir, "db.yaml")))
 	if err != nil {
 		logrus.Errorln("Failed to create db file:", err.Error())
 		return err
diff --git a/internal/config/config.go b/internal/config/config.go
@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"net/url"
 	"os"
+	"path/filepath"
 	"strings"
 )
 
@@ -96,7 +97,7 @@ func Parse(path string) (*Config, error) {
 		reader = os.Stdin
 	} else {
 		var err error
-		reader, err = os.Open(path)
+		reader, err = os.Open(filepath.Clean(path))
 		if err != nil {
 			return nil, err
 		}
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
@@ -35,7 +35,7 @@ func TestParse(t *testing.T) {
 				} else {
 					configPath = path.Join(temp, fname)
 					d1 := []byte(tc.input)
-					err := os.WriteFile(configPath, d1, 0644)
+					err := os.WriteFile(configPath, d1, 0600)
 					require.NoError(t, err)
 				}
 
diff --git a/internal/handlers/cargo_registry_test.go b/internal/handlers/cargo_registry_test.go
@@ -14,9 +14,9 @@ func TestCargoRegistryHandler(t *testing.T) {
 	validURLWithPathBase := "https://valid-url-path.example.com"
 	validURLWithPath := validURLWithPathBase + "/path"
 	invalidURL := "asdf"
-	noTokenURL := "https://no-token.example.com"
+	noTokenURL := "https://no-token.example.com" //nolint:gosec // test URL, not a credential
 
-	token := "Bearer abc123"
+	token := "Bearer abc123" //nolint:gosec // test credential
 
 	credentials := config.Credentials{
 		config.Credential{
diff --git a/internal/handlers/git_server_test.go b/internal/handlers/git_server_test.go
@@ -132,7 +132,7 @@ func TestGitServerHandler_AuthenticatedAccessToGitHubRepos(t *testing.T) {
 	installationToken2 := "v1.token2"
 	privateRepo2Cred := testGitSourceCred("github.com", "x-access-token", installationToken2, withAccessibleRepos([]string{"github/private-repo-2"}))
 
-	userToken := "ghp_fakefakefakesuperfake1"
+	userToken := "ghp_fakefakefakesuperfake1" //nolint:gosec // test credential
 	privateRepo3Cred := testGitSourceCred("github.com", "x-access-token", userToken, withAccessibleRepos([]string{"github/private-repo-3"}))
 
 	tests := []struct {
@@ -246,8 +246,8 @@ func TestGitServerHandlerNoRetry(t *testing.T) {
 
 func TestGitServerHandler_TokenFallback(t *testing.T) {
 	installationToken := "v1.token"
-	userToken1 := "ghp_fakefakefakesuperfake1"
-	userToken2 := "ghp_fakefakefakesuperfake2"
+	userToken1 := "ghp_fakefakefakesuperfake1" //nolint:gosec // test credential
+	userToken2 := "ghp_fakefakefakesuperfake2" //nolint:gosec // test credential
 	credentials := config.Credentials{
 		testGitSourceCred("github.com", "x-access-token", installationToken),
 		testGitSourceCred("github.com", "x-access-token", userToken1),
@@ -347,7 +347,7 @@ func TestGitServerHandler_TokenFallback(t *testing.T) {
 
 func TestGitServerHandler_TokenFallbackWithPost(t *testing.T) {
 	installationToken := "v1.token"
-	userToken := "ghp_fakefakefakesuperfake"
+	userToken := "ghp_fakefakefakesuperfake" //nolint:gosec // test credential
 	credentials := config.Credentials{
 		testGitSourceCred("github.com", "x-access-token", installationToken),
 		testGitSourceCred("github.com", "x-access-token", userToken),
diff --git a/internal/handlers/github_api_test.go b/internal/handlers/github_api_test.go
@@ -111,7 +111,7 @@ func TestGitHubAPIHandler_AuthenticatedAccessToGitHubRepos(t *testing.T) {
 	installationToken2 := "v1.token2"
 	privateRepo2Cred := testGitSourceCred("github.com", "x-access-token", installationToken2, withAccessibleRepos([]string{"github/private-repo-2"}))
 
-	userToken := "ghp_fakefakefakesuperfake1"
+	userToken := "ghp_fakefakefakesuperfake1" //nolint:gosec // test credential
 	privateRepo3Cred := testGitSourceCred("github.com", "x-access-token", userToken, withAccessibleRepos([]string{"github/private-repo-3"}))
 
 	tests := []struct {
@@ -312,8 +312,8 @@ func TestGitHubAPIHandler_TokenFallback(t *testing.T) {
 	installationToken1 := "v1.token1"
 	installationToken2 := "v1.token2"
 	installationToken3 := "v1.token3"
-	userToken1 := "ghp_fakefakefakesuperfake1"
-	userToken2 := "ghp_fakefakefakesuperfake2"
+	userToken1 := "ghp_fakefakefakesuperfake1" //nolint:gosec // test credential
+	userToken2 := "ghp_fakefakefakesuperfake2" //nolint:gosec // test credential
 	credentials := config.Credentials{
 		testGitSourceCred("github.com", "x-access-token", installationToken1),
 		testGitSourceCred("github.com", "x-access-token", installationToken2, withAccessibleRepos([]string{"foo/qux"})),
@@ -430,8 +430,8 @@ func TestGitHubAPIHandler_TokenFallback(t *testing.T) {
 
 func TestGitHubAPIHandler_TokenFallback_In_Proxima(t *testing.T) {
 	installationToken := "v1.token"
-	userToken1 := "ghp_fakefakefakesuperfake1"
-	userToken2 := "ghp_fakefakefakesuperfake2"
+	userToken1 := "ghp_fakefakefakesuperfake1" //nolint:gosec // test credential
+	userToken2 := "ghp_fakefakefakesuperfake2" //nolint:gosec // test credential
 	credentials := config.Credentials{
 		testGitSourceCred("foo.ghe.com", "x-access-token", installationToken),
 		testGitSourceCred("foo.ghe.com", "x-access-token", userToken1),
diff --git a/internal/handlers/oidc_handling_test.go b/internal/handlers/oidc_handling_test.go
@@ -1001,7 +1001,7 @@ func TestOIDCURLsAreAuthenticated(t *testing.T) {
 			}
 
 			// mock GitHub OIDC token request
-			tokenUrl := "https://token.actions.example.com"
+			tokenUrl := "https://token.actions.example.com" //nolint:gosec // test URL
 			httpmock.RegisterResponder("GET", tokenUrl,
 				httpmock.NewStringResponder(200, `{
 				"count": 1,
diff --git a/internal/handlers/pub_repository_test.go b/internal/handlers/pub_repository_test.go
@@ -14,9 +14,9 @@ func TestPubRepositoryHandler(t *testing.T) {
 	validURLWithPathBase := "https://valid-url-path.example.com"
 	validURLWithPath := validURLWithPathBase + "/path"
 	invalidURL := "asdf"
-	noTokenURL := "https://no-token.example.com"
+	noTokenURL := "https://no-token.example.com" //nolint:gosec // test URL, not a credential
 
-	token := "abc123"
+	token := "abc123" //nolint:gosec // test credential
 
 	credentials := config.Credentials{
 		config.Credential{
diff --git a/internal/handlers/python_index_test.go b/internal/handlers/python_index_test.go
@@ -9,8 +9,8 @@ import (
 )
 
 func TestPythonIndexHandler(t *testing.T) {
-	dependabotToken := "123"
-	dependabotSecToken := "dependabot:sec123"
+	dependabotToken := "123"                  //nolint:gosec // test credential
+	dependabotSecToken := "dependabot:sec123" //nolint:gosec // test credential
 	simpleSecToken := "simple:sec245"
 	deltaForceUser := "some-user"
 	deltaForcePassword := "456"
diff --git a/internal/oidc/actions_oidc.go b/internal/oidc/actions_oidc.go
@@ -9,6 +9,7 @@ import (
 	"encoding/xml"
 	"fmt"
 	"io"
+	"math"
 	"net/http"
 	"net/url"
 	"os"
@@ -23,13 +24,13 @@ const (
 	// GitHub Actions environment variables for OIDC token requests
 	// https://docs.github.com/en/actions/reference/security/oidc#methods-for-requesting-the-oidc-token
 	envActionsIDTokenRequestURL   = "ACTIONS_ID_TOKEN_REQUEST_URL"
-	envActionsIDTokenRequestToken = "ACTIONS_ID_TOKEN_REQUEST_TOKEN"
+	envActionsIDTokenRequestToken = "ACTIONS_ID_TOKEN_REQUEST_TOKEN" //nolint:gosec // env var name, not a credential
 
 	// Various strings required by AWS request signing
 	awsCodeArtifactTargetName    = "CodeArtifact_2018_09_22.GetAuthorizationToken"
 	awsCodeArtifactDateFormat    = "20060102T150405Z"
 	awsCodeArtifactSTSRequestUrl = "https://sts.amazonaws.com"
-	awsCodeArtifactTokenURLPath  = "/v1/authorization-token"
+	awsCodeArtifactTokenURLPath  = "/v1/authorization-token" //nolint:gosec // URL path, not a credential
 )
 
 // tokenResponse represents the response from GitHub's OIDC provider
@@ -350,8 +351,8 @@ func GetJFrogAccessToken(ctx context.Context, params JFrogOIDCParameters, github
 	}
 
 	expiresIn := time.Duration(24) * time.Hour // this is the default if not provided
-	if tokenResp.ExpiresIn != nil {
-		expiresIn = time.Duration(*tokenResp.ExpiresIn) * time.Second
+	if tokenResp.ExpiresIn != nil && *tokenResp.ExpiresIn <= uint(math.MaxInt64/uint(time.Second)) {
+		expiresIn = time.Duration(*tokenResp.ExpiresIn) * time.Second //nolint:gosec // overflow guarded above
 	}
 
 	return &OIDCAccessToken{
diff --git a/logging_test.go b/logging_test.go
@@ -10,6 +10,7 @@ import (
 	"net/url"
 	"os"
 	"path"
+	"path/filepath"
 	"regexp"
 	"strings"
 	"testing"
@@ -189,7 +190,7 @@ func TestSetupLogging(t *testing.T) {
 	logrus.Info("test [logrus]")
 	err := file.Close()
 	require.NoError(t, err)
-	text, err := os.ReadFile(logFile)
+	text, err := os.ReadFile(filepath.Clean(logFile))
 	require.NoError(t, err)
 	assert.Contains(t, string(text), "test [log]")
 	assert.Contains(t, string(text), "test [logrus]")
diff --git a/main.go b/main.go
@@ -68,8 +68,9 @@ func main() {
 	}
 
 	server := &http.Server{
-		Addr:    *addr,
-		Handler: handler,
+		Addr:              *addr,
+		Handler:           handler,
+		ReadHeaderTimeout: 10 * time.Second,
 	}
 
 	signals := make(chan os.Signal, 1)
diff --git a/proxy.go b/proxy.go
@@ -37,10 +37,12 @@ func newProxy(envSettings config.ProxyEnvSettings, cfg *config.Config, blockedIp
 	safeDialer := dialer.New(&resolver, blockedIps)
 
 	transport := &http.Transport{
-		Dial:            safeDialer.Dial,
-		DialContext:     safeDialer.DialContext,
-		TLSClientConfig: &tls.Config{},
-		Proxy:           http.ProxyFromEnvironment,
+		Dial:        safeDialer.Dial,
+		DialContext: safeDialer.DialContext,
+		TLSClientConfig: &tls.Config{
+			MinVersion: tls.VersionTLS12,
+		},
+		Proxy: http.ProxyFromEnvironment,
 	}
 
 	apiClient := apiclient.New(envSettings.APIEndpoint, envSettings.JobToken, envSettings.JobID, apiclient.WithTransport(transport))
diff --git a/proxy_test.go b/proxy_test.go
@@ -158,7 +158,9 @@ func testProxyServer(t *testing.T, cfg *config.Config, blockedIPs []net.IP) (*ht
 	}
 
 	// Spin up a test proxy server
-	srv := &http.Server{}
+	srv := &http.Server{
+		ReadHeaderTimeout: 10 * time.Second,
+	}
 	srv.Handler = newProxy(envSettings, testProxyConfig, blockedIPs)
 
 	lc := net.ListenConfig{}
@@ -187,7 +189,8 @@ func testProxyServer(t *testing.T, cfg *config.Config, blockedIPs []net.IP) (*ht
 		Transport: &http.Transport{
 			Proxy: http.ProxyURL(proxyURL),
 			TLSClientConfig: &tls.Config{
-				RootCAs: rootCAs,
+				MinVersion: tls.VersionTLS12,
+				RootCAs:    rootCAs,
 			},
 		},
 	}
@@ -197,7 +200,9 @@ func testProxyServer(t *testing.T, cfg *config.Config, blockedIPs []net.IP) (*ht
 
 func testHTTPServer(t *testing.T) (string, *http.Server) {
 	// Spin up a test HTTP server
-	srv := &http.Server{}
+	srv := &http.Server{
+		ReadHeaderTimeout: 10 * time.Second,
+	}
 	srv.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(200)
 	})

Original file line number	Diff line number	Diff line change
`@@ -25,7 +25,7 @@ import (`
`25`	`25`
`26`	`26`	`const (`
`27`	`27`	`jobID = "1234"`
`28`		`- jobToken = "hey-dependabot-api-its-me-ur-brother"`
	`28`	`+ jobToken = "hey-dependabot-api-its-me-ur-brother" //nolint:gosec // test credential`
`29`	`29`	`)`
`30`	`30`
`31`	`31`	`func TestClient_ReportMetrics_Success(t *testing.T) {`
Original file line number	Diff line number	Diff line change
`@@ -35,7 +35,7 @@ func TestParse(t *testing.T) {`
`35`	`35`	`} else {`
`36`	`36`	`configPath = path.Join(temp, fname)`
`37`	`37`	`d1 := []byte(tc.input)`
`38`		`- err := os.WriteFile(configPath, d1, 0644)`
	`38`	`+ err := os.WriteFile(configPath, d1, 0600)`
`39`	`39`	`require.NoError(t, err)`
`40`	`40`	`}`
`41`	`41`
Original file line number	Diff line number	Diff line change
`@@ -1001,7 +1001,7 @@ func TestOIDCURLsAreAuthenticated(t *testing.T) {`
`1001`	`1001`	`}`
`1002`	`1002`
`1003`	`1003`	`// mock GitHub OIDC token request`
`1004`		`- tokenUrl := "https://token.actions.example.com"`
	`1004`	`+ tokenUrl := "https://token.actions.example.com" //nolint:gosec // test URL`
`1005`	`1005`	`httpmock.RegisterResponder("GET", tokenUrl,`
`1006`	`1006`	httpmock.NewStringResponder(200, `{
`1007`	`1007`	`"count": 1,`