Skip to content

Commit 2be2a53

Browse files
ferhatelmasferhatelmas
committed
*: enable gosec linter
Signed-off-by: ferhat elmas <elmas.ferhat@gmail.com>
1 parent 22c365f commit 2be2a53

File tree

37 files changed

+127
-111
lines changed

37 files changed

+127
-111
lines changed

‎.golangci.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ linters:
55
- dupl
66
- errcheck
77
- gocritic
8+
- gosec
89
- govet
910
- ineffassign
1011
- misspell
@@ -38,6 +39,7 @@ linters:
3839
- path: _test\.go
3940
linters:
4041
- errcheck
42+
- gosec
4143

4244
formatters:
4345
enable:

‎config/config.go‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -450,11 +450,14 @@ func (c *Config) unmarshalPack() error {
450450
if window == "" {
451451
c.Pack.Window = DefaultPackWindow
452452
} else {
453-
winUint, err := strconv.ParseUint(window, 10, 32)
453+
winInt, err := strconv.Atoi(window)
454454
if err != nil {
455455
return err
456456
}
457-
c.Pack.Window = uint(winUint)
457+
if winInt < 0 {
458+
return fmt.Errorf("pack.window cannot be negative: %d", winInt)
459+
}
460+
c.Pack.Window = uint(winInt)
458461
}
459462
return nil
460463
}

‎internal/transport/test/receive_pack.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -247,7 +247,7 @@ func (s *ReceivePackSuite) receivePackNoCheck(ep *transport.Endpoint,
247247

248248
for _, file := range files {
249249
path := filepath.Join(objectPath, file.Name())
250-
err = os.Chmod(path, 0o644)
250+
err = os.Chmod(path, 0o644) //nolint:gosec // G302: test file, relaxed permissions are intentional
251251
s.Require().NoError(err)
252252
}
253253
}

‎plumbing/format/commitgraph/commitgraph.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ func (c *CommitData) GenerationV2Data() uint64 {
3333
if c.GenerationV2 == 0 || c.GenerationV2 == math.MaxUint64 {
3434
return 0
3535
}
36-
return c.GenerationV2 - uint64(c.When.Unix())
36+
return c.GenerationV2 - uint64(c.When.Unix()) //nolint:gosec // G115: Unix timestamp is always positive for valid commits
3737
}
3838

3939
// Index represents a representation of commit graph that allows indexed

‎plumbing/format/commitgraph/encoder.go‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ func (e *Encoder) Encode(idx Index) error {
3333
hashToIndex, fanout, extraEdgesCount, generationV2OverflowCount := e.prepare(idx, hashes)
3434

3535
chunkSignatures := [][]byte{OIDFanoutChunk.Signature(), OIDLookupChunk.Signature(), CommitDataChunk.Signature()}
36+
//nolint:gosec // G115: len() and hash.Size() are always small positive values
3637
chunkSizes := []uint64{szUint32 * lenFanout, uint64(len(hashes) * e.hash.Size()), uint64(len(hashes) * (e.hash.Size() + szCommitData))}
3738
if extraEdgesCount > 0 {
3839
chunkSignatures = append(chunkSignatures, ExtraEdgeListChunk.Signature())
@@ -86,7 +87,7 @@ func (e *Encoder) prepare(idx Index, hashes []plumbing.Hash) (hashToIndex map[pl
8687
hashToIndex = make(map[plumbing.Hash]uint32)
8788
fanout = make([]uint32, lenFanout)
8889
for i, hash := range hashes {
89-
hashToIndex[hash] = uint32(i)
90+
hashToIndex[hash] = uint32(i) //nolint:gosec // G115: i is loop index bounded by hashes count
9091
fanout[hash.Bytes()[0]]++
9192
}
9293

@@ -99,9 +100,9 @@ func (e *Encoder) prepare(idx Index, hashes []plumbing.Hash) (hashToIndex map[pl
99100

100101
// Find out if we will need extra edge table
101102
for i := range len(hashes) {
102-
v, _ := idx.GetCommitDataByIndex(uint32(i))
103+
v, _ := idx.GetCommitDataByIndex(uint32(i)) //nolint:gosec // G115: i is loop index
103104
if len(v.ParentHashes) > 2 {
104-
extraEdgesCount += uint32(len(v.ParentHashes) - 1)
105+
extraEdgesCount += uint32(len(v.ParentHashes) - 1) //nolint:gosec // G115: parent count is small
105106
}
106107
if hasGenerationV2 && v.GenerationV2Data() > math.MaxUint32 {
107108
generationV2OverflowCount++
@@ -114,7 +115,7 @@ func (e *Encoder) prepare(idx Index, hashes []plumbing.Hash) (hashToIndex map[pl
114115
func (e *Encoder) encodeFileHeader(chunkCount int) (err error) {
115116
if _, err = e.Write(commitFileSignature); err == nil {
116117
version := byte(1)
117-
if crypto.Hash(e.hash.Size()) == crypto.Hash(crypto.SHA256.Size()) {
118+
if crypto.Hash(e.hash.Size()) == crypto.Hash(crypto.SHA256.Size()) { //nolint:gosec // G115: hash.Size() is always small positive
118119
version = byte(2)
119120
}
120121
_, err = e.Write([]byte{1, version, byte(chunkCount), 0})
@@ -124,7 +125,7 @@ func (e *Encoder) encodeFileHeader(chunkCount int) (err error) {
124125

125126
func (e *Encoder) encodeChunkHeaders(chunkSignatures [][]byte, chunkSizes []uint64) (err error) {
126127
// 8 bytes of file header, 12 bytes for each chunk header and 12 byte for terminator
127-
offset := uint64(szSignature + szHeader + (len(chunkSignatures)+1)*(szChunkSig+szUint64))
128+
offset := uint64(szSignature + szHeader + (len(chunkSignatures)+1)*(szChunkSig+szUint64)) //nolint:gosec // G115: small constants
128129
for i, signature := range chunkSignatures {
129130
if _, err = e.Write(signature); err == nil {
130131
err = binary.WriteUint64(e, offset)
@@ -182,7 +183,7 @@ func (e *Encoder) encodeCommitData(hashes []plumbing.Hash, hashToIndex map[plumb
182183
parent2 = hashToIndex[commitData.ParentHashes[1]]
183184
default:
184185
parent1 = hashToIndex[commitData.ParentHashes[0]]
185-
parent2 = uint32(len(extraEdges)) | parentOctopusUsed
186+
parent2 = uint32(len(extraEdges)) | parentOctopusUsed //nolint:gosec // G115: extraEdges count is bounded
186187
for _, parentHash := range commitData.ParentHashes[1:] {
187188
extraEdges = append(extraEdges, hashToIndex[parentHash])
188189
}
@@ -196,7 +197,7 @@ func (e *Encoder) encodeCommitData(hashes []plumbing.Hash, hashToIndex map[plumb
196197
return extraEdges, generationV2Data, err
197198
}
198199

199-
unixTime := uint64(commitData.When.Unix())
200+
unixTime := uint64(commitData.When.Unix()) //nolint:gosec // G115: Unix timestamp is always positive for valid commits
200201
unixTime |= uint64(commitData.Generation) << 34
201202
if err = binary.WriteUint64(e, unixTime); err != nil {
202203
return extraEdges, generationV2Data, err
@@ -222,7 +223,7 @@ func (e *Encoder) encodeGenerationV2Data(generationV2Data []uint64) (overflows [
222223
for _, data := range generationV2Data {
223224
if data >= 0x80000000 {
224225
// overflow
225-
if err = binary.WriteUint32(e, uint32(head)|0x80000000); err != nil {
226+
if err = binary.WriteUint32(e, uint32(head)|0x80000000); err != nil { //nolint:gosec // G115: head is bounded
226227
return nil, err
227228
}
228229
generationV2Data[head] = data

‎plumbing/format/commitgraph/file.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,7 @@ func (fi *fileIndex) readChunkHeaders() error {
158158
if chunkType == ZeroChunk || int(chunkType) >= len(fi.offsets) {
159159
break
160160
}
161-
fi.offsets[chunkType] = int64(chunkOffset)
161+
fi.offsets[chunkType] = int64(chunkOffset) //nolint:gosec // G115: file offset fits in int64
162162
}
163163

164164
if fi.offsets[OIDFanoutChunk] <= 0 || fi.offsets[OIDLookupChunk] <= 0 || fi.offsets[CommitDataChunk] <= 0 {
@@ -332,7 +332,7 @@ func (fi *fileIndex) GetCommitDataByIndex(idx uint32) (*CommitData, error) {
332332
ParentHashes: parentHashes,
333333
Generation: genAndTime >> 34,
334334
GenerationV2: generationV2,
335-
When: time.Unix(int64(genAndTime&0x3FFFFFFFF), 0),
335+
When: time.Unix(int64(genAndTime&0x3FFFFFFFF), 0), //nolint:gosec // G115: masked timestamp fits in int64
336336
}, nil
337337
}
338338

‎plumbing/format/commitgraph/memory.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ func (mi *MemoryIndex) GetIndexByHash(h plumbing.Hash) (uint32, error) {
3939

4040
// GetHashByIndex gets the hash given an index in the commit graph
4141
func (mi *MemoryIndex) GetHashByIndex(i uint32) (plumbing.Hash, error) {
42-
if i >= uint32(len(mi.commitData)) {
42+
if i >= uint32(len(mi.commitData)) { //nolint:gosec // G115: len fits in uint32
4343
return plumbing.ZeroHash, plumbing.ErrObjectNotFound
4444
}
4545

@@ -49,7 +49,7 @@ func (mi *MemoryIndex) GetHashByIndex(i uint32) (plumbing.Hash, error) {
4949
// GetCommitDataByIndex gets the commit node from the commit graph using index
5050
// obtained from child node, if available
5151
func (mi *MemoryIndex) GetCommitDataByIndex(i uint32) (*CommitData, error) {
52-
if i >= uint32(len(mi.commitData)) {
52+
if i >= uint32(len(mi.commitData)) { //nolint:gosec // G115: len fits in uint32
5353
return nil, plumbing.ErrObjectNotFound
5454
}
5555

@@ -85,7 +85,7 @@ func (mi *MemoryIndex) Add(hash plumbing.Hash, data *CommitData) {
8585
// which allows adding nodes out of order as long as all parents
8686
// are eventually resolved
8787
data.ParentIndexes = nil
88-
mi.indexMap[hash] = uint32(len(mi.commitData))
88+
mi.indexMap[hash] = uint32(len(mi.commitData)) //nolint:gosec // G115: len fits in uint32
8989
mi.commitData = append(mi.commitData, commitData{Hash: hash, CommitData: data})
9090
if data.GenerationV2 == math.MaxUint64 { // if GenerationV2 is not available reset it to zero
9191
data.GenerationV2 = 0
@@ -105,5 +105,5 @@ func (mi *MemoryIndex) Close() error {
105105

106106
// MaximumNumberOfHashes returns the maximum number of hashes in the index.
107107
func (mi *MemoryIndex) MaximumNumberOfHashes() uint32 {
108-
return uint32(len(mi.indexMap))
108+
return uint32(len(mi.indexMap)) //nolint:gosec // G115: len fits in uint32
109109
}

‎plumbing/format/idxfile/decoder.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ func readObjectNames(idx *MemoryIndex, r io.Reader) error {
111111

112112
idx.FanoutMapping[k] = len(idx.Names)
113113

114-
nameLen := int(buckets * uint32(idx.idSize()))
114+
nameLen := int(buckets * uint32(idx.idSize())) //nolint:gosec // G115: idSize() returns small hash size (20 or 32)
115115
bin := make([]byte, nameLen)
116116
if _, err := io.ReadFull(r, bin); err != nil {
117117
return err

‎plumbing/format/idxfile/idxfile.go‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -95,14 +95,16 @@ func (idx *MemoryIndex) findHashIndex(h plumbing.Hash) (int, bool) {
9595
low := uint64(0)
9696
for {
9797
mid := (low + high) >> 1
98+
//nolint:gosec // G115: idSize() returns small hash size (20 or 32)
9899
offset := mid * uint64(idx.idSize())
99100

101+
//nolint:gosec // G115: idSize() returns small hash size (20 or 32)
100102
cmp := h.Compare(data[offset : offset+uint64(idx.idSize())])
101103
switch {
102104
case cmp < 0:
103105
high = mid
104106
case cmp == 0:
105-
return int(mid), true
107+
return int(mid), true //nolint:gosec // G115: mid is bounded by index size
106108
default:
107109
low = mid + 1
108110
}
@@ -141,10 +143,10 @@ func (idx *MemoryIndex) FindOffset(h plumbing.Hash) (int64, error) {
141143
if idx.offsetHash == nil {
142144
idx.offsetHash = make(map[int64]plumbing.Hash)
143145
}
144-
idx.offsetHash[int64(offset)] = h
146+
idx.offsetHash[int64(offset)] = h //nolint:gosec // G115: packfile offsets fit in int64
145147
idx.mu.Unlock()
146148

147-
return int64(offset), nil
149+
return int64(offset), nil //nolint:gosec // G115: packfile offsets fit in int64
148150
}
149151

150152
const isO64Mask = uint64(1) << 31
@@ -227,8 +229,9 @@ func (idx *MemoryIndex) genOffsetHash() error {
227229
for firstLevel, fanoutValue := range idx.Fanout {
228230
mappedFirstLevel := idx.FanoutMapping[firstLevel]
229231
for secondLevel := uint32(0); i < fanoutValue; i++ {
232+
//nolint:gosec // G115: idSize() returns small hash size (20 or 32)
230233
_, _ = hash.Write(idx.Names[mappedFirstLevel][secondLevel*uint32(idx.idSize()):])
231-
offset := int64(idx.getOffset(mappedFirstLevel, int(secondLevel)))
234+
offset := int64(idx.getOffset(mappedFirstLevel, int(secondLevel))) //nolint:gosec // G115: offsets fit in int64
232235
offsetHash[offset] = hash
233236
secondLevel++
234237
}

‎plumbing/format/idxfile/writer.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ func (w *Writer) OnInflatedObjectHeader(_ plumbing.ObjectType, _, _ int64) error
7575

7676
// OnInflatedObjectContent implements packfile.Observer interface.
7777
func (w *Writer) OnInflatedObjectContent(h plumbing.Hash, pos int64, crc uint32, _ []byte) error {
78-
w.Add(h, uint64(pos), crc)
78+
w.Add(h, uint64(pos), crc) //nolint:gosec // G115: pos is always non-negative in packfile
7979
return nil
8080
}
8181

@@ -114,11 +114,11 @@ func (w *Writer) createIndex() (*MemoryIndex, error) {
114114

115115
// fill the gaps between fans
116116
for j := last + 1; j < int(fan); j++ {
117-
idx.Fanout[j] = uint32(i)
117+
idx.Fanout[j] = uint32(i) //nolint:gosec // G115: i is loop index bounded by objects count
118118
}
119119

120120
// update the number of objects for this position
121-
idx.Fanout[fan] = uint32(i + 1)
121+
idx.Fanout[fan] = uint32(i + 1) //nolint:gosec // G115: i is loop index bounded by objects count
122122

123123
// we move from one bucket to another, update counters and allocate
124124
// memory
@@ -144,7 +144,7 @@ func (w *Writer) createIndex() (*MemoryIndex, error) {
144144
}
145145

146146
buf.Truncate(0)
147-
if err := binary.WriteUint32(buf, uint32(offset)); err != nil {
147+
if err := binary.WriteUint32(buf, uint32(offset)); err != nil { //nolint:gosec // G115: checked against limit above
148148
return nil, err
149149
}
150150
idx.Offset32[bucket] = append(idx.Offset32[bucket], buf.Bytes()...)
@@ -157,7 +157,7 @@ func (w *Writer) createIndex() (*MemoryIndex, error) {
157157
}
158158

159159
for j := last + 1; j < 256; j++ {
160-
idx.Fanout[j] = uint32(len(w.objects))
160+
idx.Fanout[j] = uint32(len(w.objects)) //nolint:gosec // G115: objects count fits in uint32
161161
}
162162

163163
idx.Version = VersionSupported

0 commit comments

Comments
 (0)