Repository navigation
fix: resolve open gosec code-scanning alerts - #54
Merged
Merged
Conversation
- G710 (http_transport): HTTPS redirect no longer trusts the raw Host header; uses configured BaseURL host or a strictly validated hostname[:port], else 400. Target built with url.URL. - G704 (osm DoRequest/MonitoredDoRequest): enforce an allow-list of the fixed Nominatim/Overpass/OSRM hosts before sending; targeted #nosec since the taint analyzer cannot see the check. - G704 (core WithRetry): require absolute http(s) URL with host; callers build URLs from fixed base URLs. Remove unused fetchImageFromURL, the only path that accepted an arbitrary URL. - G301/G104 (routes): /tmp/routes created 0750; close/remove errors are handled so a failed flush is not returned as a valid route file. - G115 (polyline): mask chunks to 6 bits before byte conversion. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
…ages - polyline: map 6-bit chunks through a 64-char alphabet instead of an int->byte conversion (gosec G115 still fired on the masked cast). - routes: drop the dead turn-by-turn segment loop whose result was never used since the minimal response omits segments (staticcheck SA4010). - ci/go workflows: continue-on-error on the Codecov upload step; its TLS handshake failure was failing the build job. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves the 8 open gosec code-scanning alerts (#6-#10, #12-#14).
pkg/server/http_transport.goBaseURL, else Host header must match stricthostname[:port]; otherwise 400. URL built withurl.URL. Clears without#nosec.pkg/osm/client.go,pkg/osm/monitoring.govalidateOutboundRequestenforces http(s) + allow-list of Nominatim/Overpass/OSRM hosts. Targeted#nosec G704because gosec's taint analysis can't see the check.pkg/core/http.govalidateOutboundURLrequires absolute http(s) URL with host; targeted#nosec G704. Removed unusedfetchImageFromURL, the only helper that accepted an arbitrary URL.pkg/tools/routes.go/tmp/routescreated0750(files are already0600viaCreateTemp).pkg/tools/routes.goClose()so a failed flush isn't returned as a valid route file.pkg/osm/polyline.go(x2)polylineChar. Clears without#nosec.Tests added: redirect hardening (
pkg/server/https_redirect_test.go) and disallowed-host rejection (metadata IP, localhost,file://) forDoRequest/MonitoredDoRequest. Existing monitoring tests register their httptest host via a test-only helper.Verification:
go build ./... && go vet ./... && go test ./...all pass. gosec v2.29.0 locally: all 8 alerts gone; only the 3 pre-existing G101 findings remain (not in the open-alert list).🤖 Generated with Claude Code