From 3de90b59bf95a35b9d5007e91898a47ac4aaf303 Mon Sep 17 00:00:00 2001 From: Ion Alpha Date: Wed, 4 Nov 2026 09:35:15 +0000 Subject: [PATCH] fix(sandbox): annotate the hidden-path Lstat for gosec G703 gosec's taint analysis reports G703 (path traversal) on the os.Lstat in hidePath, but only on some runs: dependabot PR #668 failed lint on it when the module cache failed to restore, and passed on a rerun. A release build that hits a cold cache would fail the same way. The finding does not apply. p names a path the policy wants hidden, and hidePath only covers it with an empty tmpfs or /dev/null, so a traversal in p can hide more but never lets the command read more. Signed-off-by: Ion Alpha --- sandbox/readdeny_linux.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sandbox/readdeny_linux.go b/sandbox/readdeny_linux.go index ab9fe754..bf0c6cff 100644 --- a/sandbox/readdeny_linux.go +++ b/sandbox/readdeny_linux.go @@ -29,7 +29,7 @@ func hideUnreadable(paths []string) error { // hidePath covers one path. A directory gets a read-only, empty tmpfs that no one can // enter; anything else gets /dev/null bound over it. func hidePath(p string) error { - info, err := os.Lstat(p) + info, err := os.Lstat(p) //nolint:gosec // G703: p names a path to hide; covering it only removes access, so a traversal in p cannot widen what the command reads if errors.Is(err, os.ErrNotExist) { return nil }