From 4a18bd939d4271478093c97068596bb8d719a36e Mon Sep 17 00:00:00 2001 From: Ryan Richard Date: Thu, 27 Aug 2026 14:48:37 -0700 Subject: [PATCH] upgrade linter to 2.13.1 Signed-off-by: Ryan Richard --- hack/lib/lint-version.txt | 2 +- .../controller/authenticator/authncache/cache_test.go | 3 ++- internal/controllerinit/controllerinit.go | 4 ++-- .../federationdomain/endpoints/auth/auth_handler.go | 5 ++++- .../endpoints/login/post_login_handler.go | 1 + .../federationdomain/endpointsmanager/manager_test.go | 1 + internal/groupsuffix/groupdata.go | 11 +++-------- internal/net/phttp/warning.go | 1 - internal/upstreamgithub/upstreamgithub_test.go | 1 - internal/upstreamoidc/upstreamoidc_test.go | 4 ---- pkg/oidcclient/login.go | 1 - pkg/oidcclient/login_test.go | 1 - test/integration/formposthtml_test.go | 2 -- 13 files changed, 14 insertions(+), 23 deletions(-) diff --git a/hack/lib/lint-version.txt b/hack/lib/lint-version.txt index 7cd5929f9..94f15e9cc 100644 --- a/hack/lib/lint-version.txt +++ b/hack/lib/lint-version.txt @@ -1 +1 @@ -2.11.4 +2.13.1 diff --git a/internal/controller/authenticator/authncache/cache_test.go b/internal/controller/authenticator/authncache/cache_test.go index 68520588a..b9c36b9b9 100644 --- a/internal/controller/authenticator/authncache/cache_test.go +++ b/internal/controller/authenticator/authncache/cache_test.go @@ -1,4 +1,4 @@ -// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved. +// Copyright 2020-2026 the Pinniped contributors. All Rights Reserved. // SPDX-License-Identifier: Apache-2.0 package authncache @@ -74,6 +74,7 @@ func TestCache(t *testing.T) { } for range 10 { cache := New() + //nolint:gosec // this is a test, and the shuffle does not need to be cryptographically random for _, i := range rand.Perm(len(keysInExpectedOrder)) { cache.Store(keysInExpectedOrder[i], nil) } diff --git a/internal/controllerinit/controllerinit.go b/internal/controllerinit/controllerinit.go index 8129d65aa..0b94d1ea9 100644 --- a/internal/controllerinit/controllerinit.go +++ b/internal/controllerinit/controllerinit.go @@ -1,4 +1,4 @@ -// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved. +// Copyright 2021-2026 the Pinniped contributors. All Rights Reserved. // SPDX-License-Identifier: Apache-2.0 package controllerinit @@ -78,7 +78,7 @@ func anyToFullname(a any) string { } func typeToFullname(typ reflect.Type) string { - if typ.Kind() == reflect.Ptr { + if typ.Kind() == reflect.Pointer { typ = typ.Elem() } return typ.PkgPath() + "." + typ.Name() diff --git a/internal/federationdomain/endpoints/auth/auth_handler.go b/internal/federationdomain/endpoints/auth/auth_handler.go index f55b783c8..9394ef0b1 100644 --- a/internal/federationdomain/endpoints/auth/auth_handler.go +++ b/internal/federationdomain/endpoints/auth/auth_handler.go @@ -1,4 +1,4 @@ -// Copyright 2020-2025 the Pinniped contributors. All Rights Reserved. +// Copyright 2020-2026 the Pinniped contributors. All Rights Reserved. // SPDX-License-Identifier: Apache-2.0 // Package auth provides a handler for the OIDC authorization endpoint. @@ -139,6 +139,7 @@ func (h *authorizeHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { if shouldShowIDPChooser(h.idpFinder, idpNameQueryParamValue, requestedBrowserlessFlow) { // Redirect to the IDP chooser page with all the same query/form params. When the user chooses an IDP, // it will redirect back to here with all the same params again, with the pinniped_idp_name param added. + //nolint:gosec // not an open redirect: the destination is always this server's own issuer URL http.Redirect(w, r, fmt.Sprintf("%s%s?%s", h.downstreamIssuerURL, oidc.ChooseIDPEndpointPath, r.Form.Encode()), http.StatusSeeOther, @@ -289,6 +290,7 @@ func (h *authorizeHandler) authorizeWithBrowser( return "", err } + //nolint:gosec // not an open redirect: redirectURL is built from operator-configured IDP settings http.Redirect(w, r, redirectURL, http.StatusSeeOther, // match fosite and https://tools.ietf.org/id/draft-ietf-oauth-security-topics-18.html#section-4.11 ) @@ -509,6 +511,7 @@ func addCSRFSetCookieHeader(w http.ResponseWriter, csrfValue csrftoken.CSRFToken return fmt.Errorf("error encoding CSRF cookie: %w", err) } + //nolint:gosec // SameSite=None is intentional and required for response_mode=form_post http.SetCookie(w, &http.Cookie{ // Because of the other settings below, this value can only be known by the end user's browser, not by other sites. Value: encodedCSRFValue, diff --git a/internal/federationdomain/endpoints/login/post_login_handler.go b/internal/federationdomain/endpoints/login/post_login_handler.go index 023ece1f6..0aea37d0f 100644 --- a/internal/federationdomain/endpoints/login/post_login_handler.go +++ b/internal/federationdomain/endpoints/login/post_login_handler.go @@ -139,6 +139,7 @@ func redirectToLoginPage( return err } + //nolint:gosec // not an open redirect: the destination is always this server's own issuer URL http.Redirect(w, r, loginURL, http.StatusSeeOther, // match fosite and https://tools.ietf.org/id/draft-ietf-oauth-security-topics-18.html#section-4.11 diff --git a/internal/federationdomain/endpointsmanager/manager_test.go b/internal/federationdomain/endpointsmanager/manager_test.go index 4f19968fb..44c12b98a 100644 --- a/internal/federationdomain/endpointsmanager/manager_test.go +++ b/internal/federationdomain/endpointsmanager/manager_test.go @@ -200,6 +200,7 @@ func TestManager(t *testing.T) { numberOfKubeActionsBeforeThisRequest := len(kubeClient.Actions()) getRequest := newGetRequest(requestIssuer + oidc.CallbackEndpointPath + requestURLSuffix) + //nolint:gosec // this is a request cookie in a test, so response-only attributes do not apply getRequest.AddCookie(&http.Cookie{ Name: "__Host-pinniped-csrf-v2", Value: csrfCookieValue, diff --git a/internal/groupsuffix/groupdata.go b/internal/groupsuffix/groupdata.go index 14e3fb11e..d72594929 100644 --- a/internal/groupsuffix/groupdata.go +++ b/internal/groupsuffix/groupdata.go @@ -1,4 +1,4 @@ -// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved. +// Copyright 2021-2026 the Pinniped contributors. All Rights Reserved. // SPDX-License-Identifier: Apache-2.0 package groupsuffix @@ -25,13 +25,8 @@ func ConciergeAggregatedGroups(apiGroupSuffix string) (login, identity GroupData panic("static group input is invalid") } - return GroupData{ - Group: loginConciergeAPIGroup, - Version: loginv1alpha1.SchemeGroupVersion.Version, - }, GroupData{ - Group: identityConciergeAPIGroup, - Version: identityv1alpha1.SchemeGroupVersion.Version, - } + return GroupData{Group: loginConciergeAPIGroup, Version: loginv1alpha1.SchemeGroupVersion.Version}, + GroupData{Group: identityConciergeAPIGroup, Version: identityv1alpha1.SchemeGroupVersion.Version} } func SupervisorAggregatedGroups(apiGroupSuffix string) (clientSecret GroupData) { diff --git a/internal/net/phttp/warning.go b/internal/net/phttp/warning.go index fb3646c57..a8fe4dbee 100644 --- a/internal/net/phttp/warning.go +++ b/internal/net/phttp/warning.go @@ -40,7 +40,6 @@ func getWarningHandler() rest.WarningHandler { // the client-go rest.WarningHandlers all log warnings with non-empty message and code=299, agent is ignored // no deduplication or color output when running from a non-terminal such as a pod - //nolint:gosec // casting to an int is the documented way to call this function if isTerm := term.IsTerminal(int(os.Stderr.Fd())); !isTerm { return rest.WarningLogger{} } diff --git a/internal/upstreamgithub/upstreamgithub_test.go b/internal/upstreamgithub/upstreamgithub_test.go index 391633c0d..f5234371a 100644 --- a/internal/upstreamgithub/upstreamgithub_test.go +++ b/internal/upstreamgithub/upstreamgithub_test.go @@ -126,7 +126,6 @@ func TestExchangeAuthcode(t *testing.T) { require.NotEmpty(t, r.Header.Get("Content-Length")) // Get the params. - //nolint:gosec // this is a test, so we don't care about limiting request body size err := r.ParseForm() require.NoError(t, err) params := r.PostForm diff --git a/internal/upstreamoidc/upstreamoidc_test.go b/internal/upstreamoidc/upstreamoidc_test.go index 63a5ad23e..8ecda3f86 100644 --- a/internal/upstreamoidc/upstreamoidc_test.go +++ b/internal/upstreamoidc/upstreamoidc_test.go @@ -284,7 +284,6 @@ func TestProviderConfig(t *testing.T) { t.Run(tt.name, func(t *testing.T) { tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { require.Equal(t, http.MethodPost, r.Method) - //nolint:gosec // this is a test, so we don't care about limiting request body size require.NoError(t, r.ParseForm()) require.Equal(t, 6, len(r.Form)) require.Equal(t, "password", r.Form.Get("grant_type")) @@ -457,7 +456,6 @@ func TestProviderConfig(t *testing.T) { t.Run(tt.name, func(t *testing.T) { tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { require.Equal(t, http.MethodPost, r.Method) - //nolint:gosec // this is a test, so we don't care about limiting request body size require.NoError(t, r.ParseForm()) require.Equal(t, 4, len(r.Form)) require.Equal(t, "test-client-id", r.Form.Get("client_id")) @@ -696,7 +694,6 @@ func TestProviderConfig(t *testing.T) { numRequests++ require.LessOrEqual(t, numRequests, 2) require.Equal(t, http.MethodPost, r.Method) - //nolint:gosec // this is a test, so we don't care about limiting request body size require.NoError(t, r.ParseForm()) if numRequests == 1 { // First request should use client_id/client_secret params. @@ -1455,7 +1452,6 @@ func TestProviderConfig(t *testing.T) { t.Run(tt.name, func(t *testing.T) { tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { require.Equal(t, http.MethodPost, r.Method) - //nolint:gosec // this is a test, so we don't care about limiting request body size require.NoError(t, r.ParseForm()) require.Len(t, r.Form, 6) require.Equal(t, "test-client-id", r.Form.Get("client_id")) diff --git a/pkg/oidcclient/login.go b/pkg/oidcclient/login.go index 732ea3e52..7801d2b85 100644 --- a/pkg/oidcclient/login.go +++ b/pkg/oidcclient/login.go @@ -77,7 +77,6 @@ const ( // stdin returns the file descriptor for stdin as an int. func stdin() int { - //nolint:gosec // casting like this is the documented way to pass file descriptors to the term package return int(os.Stdin.Fd()) } diff --git a/pkg/oidcclient/login_test.go b/pkg/oidcclient/login_test.go index 6aee17244..eaf70249e 100644 --- a/pkg/oidcclient/login_test.go +++ b/pkg/oidcclient/login_test.go @@ -325,7 +325,6 @@ func TestLogin(t *testing.T) { //nolint:gocyclo http.Error(w, "unexpected method", http.StatusMethodNotAllowed) return } - //nolint:gosec // this is a test, so we don't care about limiting request body size if err := r.ParseForm(); err != nil { http.Error(w, err.Error(), http.StatusBadRequest) return diff --git a/test/integration/formposthtml_test.go b/test/integration/formposthtml_test.go index a2d728160..ad6f2df09 100644 --- a/test/integration/formposthtml_test.go +++ b/test/integration/formposthtml_test.go @@ -121,13 +121,11 @@ func formpostCallbackServer(t *testing.T) (string, func(*testing.T, url.Values)) // Allow CORS requests. w.Header().Set("Access-Control-Allow-Origin", "*") - //nolint:gosec // this is a test, so we don't care about limiting request body size assert.NoError(t, r.ParseForm()) // Extract only the POST parameters (r.Form also contains URL query parameters). postParams := url.Values{} for k := range r.Form { - //nolint:gosec // this is a test, so we don't care about limiting request body size if v := r.PostFormValue(k); v != "" { postParams.Set(k, v) }