fix: use os.Root to resolve gosec G122 lint in man page generation#730
Conversation
Signed-off-by: Sypher845 <suyashpatil845@gmail.com>
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #730 +/- ##
=========================================
- Coverage 10.99% 7.44% -3.55%
=========================================
Files 173 261 +88
Lines 8671 12945 +4274
=========================================
+ Hits 953 964 +11
- Misses 7612 11872 +4260
- Partials 106 109 +3 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
Updates the man page post-processing generator to address gosec G122 (TOCTOU) by scoping file reads/writes to a directory root handle, preventing symlink traversal escapes during cleanup.
Changes:
- Introduces
os.OpenRootand routes file I/O through the root handle (root.Open,root.OpenFile) - Switches traversal from
filepath.Walktofilepath.WalkDir - Replaces
os.ReadFile/os.WriteFilewith streaming read/write viaio.ReadAllandWrite
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| } | ||
| _, err = wf.Write([]byte(cleanedContent)) | ||
| wf.Close() | ||
| if err != nil { | ||
| return err |
There was a problem hiding this comment.
The file handles are closed without checking Close() errors, and the write path doesn’t guard against short writes. It’s safer to handle Close() errors (especially for writes) and ensure the full buffer is written, so failures (e.g., disk full / flush errors) aren’t silently ignored.
bupd
left a comment
There was a problem hiding this comment.
please resolve requested changes.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Prasanth Baskar <bupdprasanth@gmail.com>
|
fixed it for ya. !! |
…oharbor#730) Co-authored-by: Prasanth Baskar <bupdprasanth@gmail.com>
…oharbor#730) (#3) Co-authored-by: suyash845 <162715611+Sypher845@users.noreply.github.com> Co-authored-by: Prasanth Baskar <bupdprasanth@gmail.com>
Fixes #729
In
doc/man-docs/man-doc.goto avoid TOCTOU race condition the following changes were made,Before
filepath.Walkwithos.ReadFileandos.WriteFileusing full file paths directlyAfter
os.OpenRootto scope all file operations to the doc directoryfilepath.Walkwithfilepath.WalkDir(root.Open, root.OpenFile), which prevents symlink escapes