diff --git a/.golangci.yml b/.golangci.yml index a66e987c00..ff727b8c5e 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -1,12 +1,12 @@ linters: enable: - bodyclose + - copyloopvar # Detects places where loop variables are copied. - depguard - dogsled - dupword # Detects duplicate words. - durationcheck - errchkjson - - exportloopref # Detects pointers to enclosing loop variables. - gocritic # Metalinter; detects bugs, performance, and styling issues. - gocyclo - gofumpt # Detects whether code was gofumpt-ed. @@ -52,6 +52,13 @@ linters-settings: desc: The io/ioutil package has been deprecated, see https://go.dev/doc/go1.16#ioutil gocyclo: min-complexity: 16 + gosec: + excludes: + - G104 # G104: Errors unhandled; (TODO: reduce unhandled errors, or explicitly ignore) + - G113 # G113: Potential uncontrolled memory consumption in Rat.SetString (CVE-2022-23772); (only affects go < 1.16.14. and go < 1.17.7) + - G115 # G115: integer overflow conversion; (TODO: verify these: https://github.com/docker/cli/issues/5584) + - G306 # G306: Expect WriteFile permissions to be 0600 or less (too restrictive; also flags "0o644" permissions) + - G307 # G307: Deferring unsafe method "*os.File" on type "Close" (also EXC0008); (TODO: evaluate these and fix where needed: G307: Deferring unsafe method "*os.File" on type "Close") govet: enable: - shadow @@ -87,6 +94,10 @@ issues: # The default exclusion rules are a bit too permissive, so copying the relevant ones below exclude-use-default: false + # This option has been defined when Go modules was not existed and when the + # golangci-lint core was different, this is not something we still recommend. + exclude-dirs-use-default: false + exclude: - parameter .* always receives @@ -104,6 +115,9 @@ issues: # # These exclusion patterns are copied from the default excluses at: # https://github.com/golangci/golangci-lint/blob/v1.44.0/pkg/config/issues.go#L10-L104 + # + # The default list of exclusions can be found at: + # https://golangci-lint.run/usage/false-positives/#default-exclusions # EXC0001 - text: "Error return value of .((os\\.)?std(out|err)\\..*|.*Close|.*Flush|os\\.Remove(All)?|.*print(f|ln)?|os\\.(Un)?Setenv). is not checked" @@ -121,11 +135,6 @@ issues: - text: "Subprocess launch(ed with variable|ing should be audited)" linters: - gosec - # EXC0008 - # TODO: evaluate these and fix where needed: G307: Deferring unsafe method "*os.File" on type "Close" (gosec) - - text: "G307" - linters: - - gosec # EXC0009 - text: "(Expect directory permissions to be 0750 or less|Expect file permissions to be 0600 or less)" linters: @@ -135,26 +144,6 @@ issues: linters: - gosec - # G113 Potential uncontrolled memory consumption in Rat.SetString (CVE-2022-23772) - # only affects gp < 1.16.14. and go < 1.17.7 - - text: "G113" - linters: - - gosec - # TODO: G104: Errors unhandled. (gosec) - - text: "G104" - linters: - - gosec - # Looks like the match in "EXC0007" above doesn't catch this one - # TODO: consider upstreaming this to golangci-lint's default exclusion rules - - text: "G204: Subprocess launched with a potential tainted input or cmd arguments" - linters: - - gosec - # Looks like the match in "EXC0009" above doesn't catch this one - # TODO: consider upstreaming this to golangci-lint's default exclusion rules - - text: "G306: Expect WriteFile permissions to be 0600 or less" - linters: - - gosec - # TODO: make sure all packages have a description. Currently, there's 67 packages without. - text: "package-comments: should have a package comment" linters: diff --git a/cli-plugins/manager/candidate.go b/cli-plugins/manager/candidate.go index 83e5a05256..e65ac1a54f 100644 --- a/cli-plugins/manager/candidate.go +++ b/cli-plugins/manager/candidate.go @@ -17,5 +17,5 @@ func (c *candidate) Path() string { } func (c *candidate) Metadata() ([]byte, error) { - return exec.Command(c.path, MetadataSubcommandName).Output() + return exec.Command(c.path, MetadataSubcommandName).Output() // #nosec G204 -- ignore "Subprocess launched with a potential tainted input or cmd arguments" } diff --git a/cli-plugins/manager/manager.go b/cli-plugins/manager/manager.go index 9886830240..f9229c5257 100644 --- a/cli-plugins/manager/manager.go +++ b/cli-plugins/manager/manager.go @@ -240,7 +240,8 @@ func PluginRunCommand(dockerCli command.Cli, name string, rootcmd *cobra.Command // TODO: why are we not returning plugin.Err? return nil, errPluginNotFound(name) } - cmd := exec.Command(plugin.Path, args...) + cmd := exec.Command(plugin.Path, args...) // #nosec G204 -- ignore "Subprocess launched with a potential tainted input or cmd arguments" + // Using dockerCli.{In,Out,Err}() here results in a hang until something is input. // See: - https://github.com/golang/go/issues/10338 // - https://github.com/golang/go/commit/d000e8742a173aa0659584aa01b7ba2834ba28ab diff --git a/cli-plugins/manager/plugin.go b/cli-plugins/manager/plugin.go index 877241e0b8..5576ef4301 100644 --- a/cli-plugins/manager/plugin.go +++ b/cli-plugins/manager/plugin.go @@ -112,7 +112,7 @@ func (p *Plugin) RunHook(ctx context.Context, hookData HookPluginData) ([]byte, return nil, wrapAsPluginError(err, "failed to marshall hook data") } - pCmd := exec.CommandContext(ctx, p.Path, p.Name, HookSubcommandName, string(hDataBytes)) + pCmd := exec.CommandContext(ctx, p.Path, p.Name, HookSubcommandName, string(hDataBytes)) // #nosec G204 -- ignore "Subprocess launched with a potential tainted input or cmd arguments" pCmd.Env = os.Environ() pCmd.Env = append(pCmd.Env, ReexecEnvvar+"="+os.Args[0]) hookCmdOutput, err := pCmd.Output() diff --git a/dockerfiles/Dockerfile.lint b/dockerfiles/Dockerfile.lint index 9f60221c86..d209615652 100644 --- a/dockerfiles/Dockerfile.lint +++ b/dockerfiles/Dockerfile.lint @@ -2,7 +2,7 @@ ARG GO_VERSION=1.22.8 ARG ALPINE_VERSION=3.20 -ARG GOLANGCI_LINT_VERSION=v1.59.1 +ARG GOLANGCI_LINT_VERSION=v1.61.0 FROM golangci/golangci-lint:${GOLANGCI_LINT_VERSION}-alpine AS golangci-lint