From 55e6b304a513d342905d8c91ffa59fec74d2e539 Mon Sep 17 00:00:00 2001 From: korya <148461+korya@users.noreply.github.com> Date: Fri, 7 Aug 2026 14:42:35 -0400 Subject: [PATCH] chore(gosec): Suppress the G704 SSRF false positive in Client.Do gosec 2.28.0 added rule G704 (SSRF via taint analysis), which traces the URL from argv into c.getHttpClient().Do(req) and fails `just pre-commit` on an otherwise unchanged tree. The finding is a false positive by construction. SSRF requires an attacker to supply a URL to a service holding network reach the attacker lacks. Here the URL is a command-line argument of a CLI the operator runs themselves, so no trust boundary is crossed -- anyone who can pass that argument can already run curl. Disabling redirects (CheckRedirect returns ErrUseLastResponse) further keeps a response from steering the request somewhere unintended. Previously `just pre-commit` exited 1 on the security recipe. Now it exits 0 via a call-site annotation rather than a global -exclude, so G704 still applies to any future call site. Out of scope: pinning the gosec version. Both the Justfile and CI install gosec@latest, so a future release can break the pipeline again with no code change on our side. Also corrects a typo in the adjacent G402 annotation ("askef" -> "asked"). Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_019EMMhgmTkbzAsmeNy97PrP --- main.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/main.go b/main.go index 511d881..94ddb0e 100644 --- a/main.go +++ b/main.go @@ -293,7 +293,10 @@ func (c Client) Do(req *http.Request, assertions ...Assertion) error { c.logInfo("[.] %s %s %s", req.Proto, req.Method, req.URL) startedAt := time.Now() - res, err := c.getHttpClient().Do(req) + // G704: the request URL comes from the operator's own command line, and + // fetching it is the entire purpose of this tool -- no trust boundary is + // crossed, so this is not SSRF. + res, err := c.getHttpClient().Do(req) // #nosec G704 - user asked for this URL if err != nil { var b strings.Builder fmt.Fprintf(&b, "failed to send request:\n- %s\n", err) @@ -356,7 +359,7 @@ func (c Client) getHttpClient() *http.Client { }, } if c.SkipSslChecks { - tr.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // #nosec G402 - user askef for it + tr.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // #nosec G402 - user asked for it } return &http.Client{