sneak/pixa
1
0
Fork 0
Code Issues 5 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix: suppress gosec G703 false positive on state_dir probe removal

Browse Source 
The pinned CI linter (golangci-lint v2.10.1) flags os.Remove(probePath)
in ensureStateDirWritable as G703 path traversal via taint analysis.
probePath comes from os.CreateTemp inside the StateDir that the probe
just validated, so the taint finding is a false positive; suppress it
with a justified nolint comment matching the existing precedent in
loadConfigFile. Verified against the pinned linter version via the
Dockerfile lint stage (0 issues).
This commit is contained in:
Jeffrey Paul
2026-08-07 17:00:20 +00:00
parent 745a461688
commit 11e9206c21
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
internal/config/config.go
View File

@@ -206,6 +206,7 @@ func (c *Config) ensureStateDirWritable() error {
"state_dir", probePath, err) "state_dir", probePath, err)
} }
//nolint:gosec // G703: probePath comes from os.CreateTemp inside the just-validated StateDir
if err := os.Remove(probePath); err != nil { if err := os.Remove(probePath); err != nil {
return fmt.Errorf("config key %q: cannot remove probe file %q: %w", return fmt.Errorf("config key %q: cannot remove probe file %q: %w",
"state_dir", probePath, err) "state_dir", probePath, err)