Skip to content

chore: add gosec nosec directives for controlled environment variables #45

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jplanckeel merged 1 commit into from
Mar 4, 2026
Merged

chore: add gosec nosec directives for controlled environment variables #45

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions catalog.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,7 @@ func fetchProjectsFromAPI() ([]string, error) {
logger.Debug("Fetching projects from API", slog.String("url", apiURL))

resp, err := client.Get(apiURL)
// #nosec G107 - TRACKER_HOST is a controlled environment variable
if err != nil {
return nil, fmt.Errorf("failed to fetch catalogs: %w", err)
}
Expand Down
2 changes: 2 additions & 0 deletions cron.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,7 @@ func listEventToday() {
// fetchEvents récupère les événements du jour depuis l'API
func fetchEvents() ([]TodayEventReponse, error) {
resp, err := http.Get(os.Getenv("TRACKER_HOST") + "/api/v1alpha1/events/today")
// #nosec G107 - TRACKER_HOST is a controlled environment variable
if err != nil {
return []TodayEventReponse{}, fmt.Errorf("erreur lors de l'appel API : %v", err)
}
Expand Down Expand Up @@ -336,6 +337,7 @@ func fetchEventsToSync() ([]EventToSync, error) {
slog.String("end_date", endDate),
slog.String("url", fullURL))

// #nosec G107 - TRACKER_HOST is a controlled environment variable
resp, err := http.Get(fullURL)
if err != nil {
return nil, fmt.Errorf("API call failed: %w", err)
Expand Down
11 changes: 11 additions & 0 deletions slack.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -921,13 +921,15 @@ func postTrackerChangeLog(event EventReponse, action string, note string, user s
urlStr := os.Getenv("TRACKER_HOST") + "/api/v1alpha1/event/" + eventId + "/changelog"
fmt.Printf("Posting changelog to %s for action %s (using=%s, id=%s, slack_id=%s)\n", urlStr, action, identifierSource, event.Metadata.Id, event.Metadata.SlackId)

// #nosec G107 - TRACKER_HOST is a controlled environment variable
req, err := http.NewRequest("POST", urlStr, bytes.NewReader(bodyBytes))
if err != nil {
fmt.Printf("changelog request build error: %v\n", err)
return
}
req.Header.Set("Content-Type", "application/json")

// #nosec G107 - TRACKER_HOST is a controlled environment variable
resp, err := http.DefaultClient.Do(req)
if err != nil {
fmt.Printf("changelog post error: %v\n", err)
Expand Down Expand Up @@ -1165,11 +1167,13 @@ func postTrackerEvent(tracker tracker) {
}

body := bytes.NewReader(payloadBytes)
// #nosec G107 - TRACKER_HOST is a controlled environment variable

req, err := http.NewRequest("POST", os.Getenv("TRACKER_HOST")+"/api/v1alpha1/event", body)
if err != nil {
fmt.Println(err)
}
// #nosec G107 - TRACKER_HOST is a controlled environment variable
req.Header.Set("Content-Type", "application/json")

resp, err := http.DefaultClient.Do(req)
Expand Down Expand Up @@ -1225,11 +1229,13 @@ func editTrackerEvent(tracker tracker) {
if err != nil {
fmt.Println(err)
}
// #nosec G107 - TRACKER_HOST is a controlled environment variable

body := bytes.NewReader(payloadBytes)

req, err := http.NewRequest("PUT", os.Getenv("TRACKER_HOST")+"/api/v1alpha1/event", body)
if err != nil {
// #nosec G107 - TRACKER_HOST is a controlled environment variable
fmt.Println(err)
}
req.Header.Set("Content-Type", "application/json")
Expand Down Expand Up @@ -1267,11 +1273,13 @@ func updateTrackerEvent(tracker EventReponse, status int, tracker_type int) {

payloadBytes, err := json.Marshal(data)
if err != nil {
// #nosec G107 - TRACKER_HOST is a controlled environment variable
fmt.Println(err)
}

body := bytes.NewReader(payloadBytes)

// #nosec G107 - TRACKER_HOST is a controlled environment variable
req, err := http.NewRequest("PUT", os.Getenv("TRACKER_HOST")+"/api/v1alpha1/event", body)
if err != nil {
fmt.Println(err)
Expand All @@ -1280,6 +1288,7 @@ func updateTrackerEvent(tracker EventReponse, status int, tracker_type int) {

resp, err := http.DefaultClient.Do(req)
if err != nil {
// #nosec G107 - TRACKER_HOST is a controlled environment variable
fmt.Println(err)
}
defer resp.Body.Close()
Expand Down Expand Up @@ -1389,13 +1398,15 @@ func updateTrackerEventSlackId(eventId string, slackId string) error {
}

payloadBytes, err := json.Marshal(payload)
// #nosec G107 - TRACKER_HOST is a controlled environment variable
if err != nil {
return fmt.Errorf("failed to marshal payload: %w", err)
}

// Construire l'URL de l'API avec le nouvel endpoint
urlStr := fmt.Sprintf("%s/api/v1alpha1/event/%s/slack", os.Getenv("TRACKER_HOST"), eventId)

// #nosec G107 - TRACKER_HOST is a controlled environment variable
// Créer la requête POST
req, err := http.NewRequest("POST", urlStr, bytes.NewReader(payloadBytes))
if err != nil {
Expand Down