rickub/cli · 89ad491

⑂ 89ad491

security: annotate the stamp read as CLI-owned, satisfying gosec G304Unverified

The stamp path is config.Path plus a sanitized host key - the same
class as the config-file read in internal/config, which carries the
same annotation for the same reason.

Olivier Girardot committed 2026-10-11T19:21:47+02:00 Browse files

89ad491 parent: b4bb81e

modified cmd/update_check.go +3 -0 Viewed

@@ -276,6 +276,9 @@ func updateStampPath(host string) (string, error) {
276	276	// interval. A missing or unreadable stamp is stale (check again); a future
277	277	// stamp (clock moved back) is treated as fresh so it cannot pinball the probe.
278	278	func stampIsFresh(path string) bool {
	279	+ // #nosec G304 -- path is the CLI's own stamp under the config directory
	280	+ // (config.Path + a sanitized host key), the same class as the config read
	281	+ // in internal/config; it is never assembled from request or command input.
279	282	data, err := os.ReadFile(path)
280	283	if err != nil {
281	284	return false

  // interval. A missing or unreadable stamp is stale (check again); a future
  // stamp (clock moved back) is treated as fresh so it cannot pinball the probe.
  func stampIsFresh(path string) bool {
++	// #nosec G304 -- path is the CLI's own stamp under the config directory
++	// (config.Path + a sanitized host key), the same class as the config read
++	// in internal/config; it is never assembled from request or command input.
  	data, err := os.ReadFile(path)
  	if err != nil {
  		return false