From 5ff5059db36ff723081c507b2409027b307645ef Mon Sep 17 00:00:00 2001 From: Dmitry Verkhoturov Date: Fri, 17 Apr 2026 03:53:18 +0100 Subject: [PATCH] chore(lint): re-enable gosec G703/G704/G705 with targeted suppressions Commit aca0cff3 silenced the path-traversal, SSRF and XSS taint rules project-wide as "false positives" while fixing image-proxy SSRF. With the path-traversal and TitleExtractor SSRF gaps now closed, restore the rules so future regressions get flagged. The four genuine false positives that remain (image proxy http.NewRequest, QR png Write, two RSS XML Writes) get individual //nolint:gosec comments naming the reason. --- backend/.golangci.yml | 3 --- backend/app/rest/api/rest_public.go | 2 +- backend/app/rest/api/rss.go | 6 +++--- 3 files changed, 4 insertions(+), 7 deletions(-) diff --git a/backend/.golangci.yml b/backend/.golangci.yml index 847653da..b99ab2c4 100644 --- a/backend/.golangci.yml +++ b/backend/.golangci.yml @@ -26,9 +26,6 @@ linters: gosec: excludes: - G117 # false positive: struct field name matches "secret" pattern - - G703 # false positive: path traversal via taint analysis - - G704 # false positive: SSRF via taint analysis - - G705 # false positive: XSS via taint analysis gocritic: disabled-checks: - wrapperFunc diff --git a/backend/app/rest/api/rest_public.go b/backend/app/rest/api/rest_public.go index 4b34c0b4..370929a1 100644 --- a/backend/app/rest/api/rest_public.go +++ b/backend/app/rest/api/rest_public.go @@ -464,7 +464,7 @@ func (s *public) telegramQrCtrl(w http.ResponseWriter, r *http.Request) { } w.Header().Set("Content-Type", "image/png") - if _, err = w.Write(png); err != nil { + if _, err = w.Write(png); err != nil { //nolint:gosec // png bytes from go-qrcode, not HTML log.Printf("[WARN] can't render qr, %v", err) } } diff --git a/backend/app/rest/api/rss.go b/backend/app/rest/api/rss.go index 82baf8f2..f9c91a37 100644 --- a/backend/app/rest/api/rss.go +++ b/backend/app/rest/api/rss.go @@ -56,7 +56,7 @@ func (s *rss) postCommentsCtrl(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "application/xml; charset=utf-8") w.WriteHeader(http.StatusOK) - if _, err = w.Write(data); err != nil { + if _, err = w.Write(data); err != nil { //nolint:gosec // xml feed bytes from gorilla/feeds, not HTML log.Printf("[WARN] failed to send response to %s, %s", r.RemoteAddr, err) } } @@ -87,7 +87,7 @@ func (s *rss) siteCommentsCtrl(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "application/xml; charset=utf-8") w.WriteHeader(http.StatusOK) - if _, err = w.Write(data); err != nil { + if _, err = w.Write(data); err != nil { //nolint:gosec // xml feed bytes from gorilla/feeds, not HTML log.Printf("[WARN] failed to send response to %s, %s", r.RemoteAddr, err) } } @@ -119,7 +119,7 @@ func (s *rss) repliesCtrl(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "application/xml; charset=utf-8") w.WriteHeader(http.StatusOK) - if _, err = w.Write(data); err != nil { + if _, err = w.Write(data); err != nil { //nolint:gosec // xml feed bytes from gorilla/feeds, not HTML log.Printf("[WARN] failed to send response to %s, %s", r.RemoteAddr, err) } }