From a96bddcb8d40092781dc53708fb0ab852f1ffd03 Mon Sep 17 00:00:00 2001 From: Dmitry Verkhoturov Date: Fri, 17 Apr 2026 04:35:31 +0100 Subject: [PATCH] chore(lint): suppress gosec G70x false positives in admin/CLI paths CI's golangci-lint v2.10.1 (newer rule set than my local 2.11.4) flags four G70x cases the previous run missed. All are false positives: backup.go and cleanup.go drive HTTP requests against the operator's own RemarkURL from CLI flags (not user input); migrator.go removes a temp file whose name was returned by os.CreateTemp (server-controlled). Add targeted //nolint:gosec comments naming the reason at each site. --- backend/app/cmd/backup.go | 2 +- backend/app/cmd/cleanup.go | 4 ++-- backend/app/rest/api/migrator.go | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/backend/app/cmd/backup.go b/backend/app/cmd/backup.go index 2e0a066a..277e7f5b 100644 --- a/backend/app/cmd/backup.go +++ b/backend/app/cmd/backup.go @@ -47,7 +47,7 @@ func (ec *BackupCommand) Execute(_ []string) error { req.SetBasicAuth("admin", ec.AdminPasswd) // get with timeout - resp, err := client.Do(req.WithContext(ctx)) + resp, err := client.Do(req.WithContext(ctx)) //nolint:gosec // exportURL is built from operator-supplied CLI flags, not user input if err != nil { return fmt.Errorf("request failed for %s: %w", exportURL, err) } diff --git a/backend/app/cmd/cleanup.go b/backend/app/cmd/cleanup.go index fba237ac..24415af3 100644 --- a/backend/app/cmd/cleanup.go +++ b/backend/app/cmd/cleanup.go @@ -199,7 +199,7 @@ func (cc *CleanupCommand) deleteComment(c store.Comment) error { //nolint:dupl / client := http.Client{} defer client.CloseIdleConnections() - r, err := client.Do(req) + r, err := client.Do(req) //nolint:gosec // RemarkURL comes from operator CLI flag, not user input if err != nil { return fmt.Errorf("delete request failed for comment %s, %s: %w", c.ID, c.Locator.URL, err) } @@ -221,7 +221,7 @@ func (cc *CleanupCommand) setTitle(c store.Comment) error { //nolint:dupl // not client := http.Client{} defer client.CloseIdleConnections() - r, err := client.Do(req) + r, err := client.Do(req) //nolint:gosec // RemarkURL comes from operator CLI flag, not user input if err != nil { return fmt.Errorf("title request failed for comment %s, %s: %w", c.ID, c.Locator.URL, err) } diff --git a/backend/app/rest/api/migrator.go b/backend/app/rest/api/migrator.go index 32afb3b1..51f7875e 100644 --- a/backend/app/rest/api/migrator.go +++ b/backend/app/rest/api/migrator.go @@ -180,7 +180,7 @@ func (m *Migrator) remapCtrl(w http.ResponseWriter, r *http.Request) { return } defer func() { - if e = os.Remove(fh.Name()); e != nil { + if e = os.Remove(fh.Name()); e != nil { //nolint:gosec // fh.Name() is from os.CreateTemp, server-controlled log.Printf("[WARN] failed to remove temp file %+v", e) } }()