From 9e399384c30a31732e148dd5ab58810e9dcbeea6 Mon Sep 17 00:00:00 2001 From: J3vb Date: Fri, 3 Apr 2026 08:45:45 +0200 Subject: [PATCH] fix: suppress gosec false positives in Linux server support - G204 in proc_spawner_nix.go and proc_spawner_win.go: exePath is the server's own validated binary path, not arbitrary user input - G302 in updater.go: 0o755 is required for the extracted Linux binary to be executable --- Server/updater/proc_spawner_nix.go | 2 +- Server/updater/proc_spawner_win.go | 2 +- Server/updater/updater.go | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Server/updater/proc_spawner_nix.go b/Server/updater/proc_spawner_nix.go index bd4d1cbd..342808bc 100644 --- a/Server/updater/proc_spawner_nix.go +++ b/Server/updater/proc_spawner_nix.go @@ -10,7 +10,7 @@ import ( // SpawnDetached starts a new process that is not attached to the current one. func SpawnDetached(exePath string, args []string) error { - cmd := exec.Command(exePath, args...) + cmd := exec.Command(exePath, args...) //nolint:gosec // G204: exePath is the server's own binary path, validated by the caller cmd.Stdout = os.Stdout cmd.Stderr = os.Stderr cmd.SysProcAttr = &syscall.SysProcAttr{ diff --git a/Server/updater/proc_spawner_win.go b/Server/updater/proc_spawner_win.go index 5d44a26b..108d6d17 100644 --- a/Server/updater/proc_spawner_win.go +++ b/Server/updater/proc_spawner_win.go @@ -10,7 +10,7 @@ import ( // SpawnDetached starts a new process that is not attached to the current one. func SpawnDetached(exePath string, args []string) error { - cmd := exec.Command(exePath, args...) + cmd := exec.Command(exePath, args...) //nolint:gosec // G204: exePath is the server's own binary path, validated by the caller cmd.Stdout = os.Stdout cmd.Stderr = os.Stderr diff --git a/Server/updater/updater.go b/Server/updater/updater.go index 92c9623b..b5f06a88 100644 --- a/Server/updater/updater.go +++ b/Server/updater/updater.go @@ -299,7 +299,7 @@ func (u *Updater) downloadLinuxTarballAndVerify(ctx context.Context, downloadURL _ = os.Remove(destPath) return fmt.Errorf("extracting archive: %w", err) } - if err := os.Chmod(destPath, 0o755); err != nil { + if err := os.Chmod(destPath, 0o755); err != nil { //nolint:gosec // G302: binary must be world-executable to run return fmt.Errorf("chmod binary: %w", err) } return nil