1st commit #1
1st commit #1
Conversation
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // calculateBackoff calculates the next delay for retry with exponential backoff and jitter. | ||
| func calculateBackoff(retry int) time.Duration { | ||
| delay := float64(baseDelay) * math.Pow(2, float64(retry)) | ||
| jitter := (rand.Float64() - 0.5) * jitterFactor * 2.0 // Random value between -jitterFactor and +jitterFactor |
Check failure
Code scanning / gosec
Use of weak random number generator (math/rand instead of crypto/rand)
| OAuthTokenEndpoint = "/api/oauth/token" // OAuthTokenEndpoint: The endpoint to obtain an OAuth token. | ||
| BearerTokenEndpoint = "/api/v1/auth/token" // BearerTokenEndpoint: The endpoint to obtain a bearer token. | ||
| TokenRefreshEndpoint = "/api/v1/auth/keep-alive" // TokenRefreshEndpoint: The endpoint to refresh an existing token. | ||
| TokenInvalidateEndpoint = "/api/v1/auth/invalidate-token" // TokenInvalidateEndpoint: The endpoint to invalidate an active token. |
Check failure
Code scanning / gosec
Potential hardcoded credentials
| DefaultBaseDomain = ".jamfcloud.com" // DefaultBaseDomain: represents the base domain for the jamf instance. | ||
| OAuthTokenEndpoint = "/api/oauth/token" // OAuthTokenEndpoint: The endpoint to obtain an OAuth token. | ||
| BearerTokenEndpoint = "/api/v1/auth/token" // BearerTokenEndpoint: The endpoint to obtain a bearer token. | ||
| TokenRefreshEndpoint = "/api/v1/auth/keep-alive" // TokenRefreshEndpoint: The endpoint to refresh an existing token. |
Check failure
Code scanning / gosec
Potential hardcoded credentials
| const ( | ||
| DefaultBaseDomain = ".jamfcloud.com" // DefaultBaseDomain: represents the base domain for the jamf instance. | ||
| OAuthTokenEndpoint = "/api/oauth/token" // OAuthTokenEndpoint: The endpoint to obtain an OAuth token. | ||
| BearerTokenEndpoint = "/api/v1/auth/token" // BearerTokenEndpoint: The endpoint to obtain a bearer token. |
Check failure
Code scanning / gosec
Potential hardcoded credentials
| // Endpoint constants represent the URL suffixes used for Jamf API token interactions. | ||
| const ( | ||
| DefaultBaseDomain = ".jamfcloud.com" // DefaultBaseDomain: represents the base domain for the jamf instance. | ||
| OAuthTokenEndpoint = "/api/oauth/token" // OAuthTokenEndpoint: The endpoint to obtain an OAuth token. |
Check failure
Code scanning / gosec
Potential hardcoded credentials
| // LoadAuthConfig reads a JSON configuration file and decodes it into a ClientAuthConfig struct. | ||
| // It is used to retrieve authentication details like BaseURL, Username, and Password for the client. | ||
| func LoadAuthConfig(filename string) (*AuthConfig, error) { | ||
| file, err := os.Open(filename) |
Check failure
Code scanning / gosec
Potential file inclusion via variable
|
|
||
| // Add the files to the form data | ||
| for formField, filepath := range files { | ||
| file, err := os.Open(filepath) |
Check failure
Code scanning / gosec
Potential file inclusion via variable
| // If reading or unmarshalling fails, an error is returned. | ||
| func LoadUserConfig(filename string) error { | ||
| // Read the user-provided JSON configuration file and unmarshal it into the global configMap. | ||
| userConfigBytes, err := os.ReadFile(filename) |
Check failure
Code scanning / gosec
Potential file inclusion via variable
***Remove unused http client default configuration*** ***Improve error handling and logging in http client*** ***Update go.sum with new dependencies
| // Endpoint constants represent the URL suffixes used for Graph API token interactions. | ||
| const ( | ||
| DefaultBaseDomain = "graph.microsoft.com" // DefaultBaseDomain: represents the base domain for graph. | ||
| TokenInvalidateEndpoint = "/api/v1/auth/invalidate-token" // TokenInvalidateEndpoint: The endpoint to invalidate an active token. |
Check failure
Code scanning / gosec
Potential hardcoded credentials
|
|
||
| // Add the files to the form data | ||
| for formField, filepath := range files { | ||
| file, err := os.Open(filepath) |
Check failure
Code scanning / gosec
Potential file inclusion via variable
| // If reading or unmarshalling fails, an error is returned. | ||
| func LoadUserConfig(filename string) error { | ||
| // Read the user-provided JSON configuration file and unmarshal it into the global configMap. | ||
| userConfigBytes, err := os.ReadFile(filename) |
Check failure
Code scanning / gosec
Potential file inclusion via variable
| // Debug method implementation | ||
| func (d *defaultLogger) Debug(msg string, keysAndValues ...interface{}) { | ||
| if d.logLevel >= LogLevelDebug { | ||
| d.logger.Debug(msg, toZapFields(keysAndValues...)...) |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information
Change
Feel free to remove this sample text
Type of Change
Please delete options that are not relevant.
Checklist