From dc0e7e02389ac09520c342170f966357dfbc388a Mon Sep 17 00:00:00 2001 From: Lukasz Raczylo Date: Tue, 19 May 2026 16:41:57 +0100 Subject: [PATCH] =?UTF-8?q?fix(oidcgate):=20gosec=20G304=20=E2=80=94=20cle?= =?UTF-8?q?an=20config=20path=20+=20native=20#nosec=20directive?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The //nolint:gosec directive only suppresses golangci-lint; the standalone gosec GitHub Action uses its own '#nosec G304 -- reason' syntax. Use both filepath.Clean as canonical mitigation and the native directive. --- cmd/oidcgate/config.go | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/cmd/oidcgate/config.go b/cmd/oidcgate/config.go index 75880ec..ff72ed0 100644 --- a/cmd/oidcgate/config.go +++ b/cmd/oidcgate/config.go @@ -4,6 +4,7 @@ import ( "encoding/json" "fmt" "os" + "path/filepath" "strings" "unicode" @@ -39,7 +40,13 @@ var envScalarFields = []string{ // Load reads YAML from path, applies env-var overrides, fills defaults, // and forces TrustForwardedURI=true so the library honors X-Forwarded-Uri. func Load(path string) (*Config, error) { - data, err := os.ReadFile(path) //nolint:gosec // path is a trusted operator-supplied config file path + // Clean the operator-supplied path to satisfy gosec G304 (file inclusion + // via variable). filepath.Clean strips traversal sequences and normalises + // the path; this is canonical mitigation for config files supplied via a + // CLI flag — the operator runs the daemon, so the input is trusted, but + // gosec's static analysis still flags variable paths without the cleanup. + clean := filepath.Clean(path) + data, err := os.ReadFile(clean) // #nosec G304 -- operator-supplied config path, cleaned above if err != nil { return nil, fmt.Errorf("read config: %w", err) }