Closed
Description
Currently, gosec
supports the #nosec
annotation comment, but in Go, comments in the form of //toolname:directive
are officially recognized as directive comments.
A directive comment is a line matching the regular expression //(line |extern |export |[a-z0-9]+:[a-z0-9]). Tools that define their own directives should use the form //toolname:directive.
https://tip.golang.org/doc/comment#syntax
Tools like gofmt
and pkgsite
(godoc
) recognize directive comments in this format.
By supporting officially formatted directive comments, gosec
can also benefit from this standardized approach.
For example:
//gosec:disable G402
Activity
ccojocar commentedon Mar 4, 2025
Thanks for bringing this up. This is useful feature for compatibility starting with Go 1.24.
//gosec:disable
directive #1314frozenbonito commentedon Mar 8, 2025
I've created a pull request.
#1314