Fix gosec findings in internal/history#79
Merged
jacobhuemmer merged 1 commit intomainfrom Apr 9, 2026
Merged
Conversation
Address gosec G301/G306/G304 findings in internal/history/: - Directories now created with 0o750 (was 0o755) - Record files and .log.gz archives written with 0o600 (was 0o644) - loadRecord defensively applies filepath.Base to the input filename and is annotated #nosec G304; the filename always originates from os.ReadDir(s.dir) filtered to *.json entries. Execution history may contain sensitive parameter values, so user-only perms are appropriate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves the 5 open gosec code-scanning alerts in
internal/history/(all introduced by the v0.12.0 execution-history feature):os.MkdirAllperms 0755 → 0750os.WriteFileperms 0644 → 0600loadRecordwraps filename infilepath.Baseand annotates#nosec G304; input always comes fromos.ReadDir(s.dir)filtered to*.jsonExecution history records may contain sensitive parameter values, so user-only perms are the right default.
Test plan
go build ./...go test ./internal/history/...