Skip to content

chore: hardening code paths #39

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tac0turtle merged 5 commits into from
Mar 13, 2026
Merged

chore: hardening code paths #39

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
0ea1f3d
Harden storage and codify API contracts
tac0turtle Mar 8, 2026
b541bc7
add more linters
tac0turtle Mar 8, 2026
8469aa7
wrapping
tac0turtle Mar 8, 2026
659911e
lint fixes
tac0turtle Mar 13, 2026
17b168d
address comments
tac0turtle Mar 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 63 additions & 1 deletion .golangci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,16 +5,78 @@ run:

linters:
enable:
# complexity
- gocyclo
- misspell

# correctness
- bodyclose
- errorlint
- exhaustive
- nilerr
- noctx

# security
- gosec

# performance
- intrange
- perfsprint
- prealloc
- unconvert

# code hygiene
- goconst
- misspell
- protogetter
- revive
- unparam

settings:
gocyclo:
min-complexity: 15
goconst:
min-len: 3
min-occurrences: 3
exhaustive:
default-signifies-exhaustive: true
gosec:
excludes:
- G104 # unhandled errors — covered by errcheck (default linter)
- G115 # integer overflow conversion — too noisy for blockchain height math
- G117 # struct field name matches secret pattern — false positive
- G304 # file inclusion via variable — expected for config loading
- G306 # file permissions > 0600 — config templates, not secrets
- G704 # SSRF via taint — HTTP clients use configured URLs, not user input

@coderabbitai coderabbitai Bot Mar 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

For golangci-lint v2 + gosec, confirm (1) whether G704 is a valid supported gosec rule ID, and (2) the recommended config pattern to scope gosec suppressions by path/message instead of global linters.settings.gosec.excludes.

💡 Result:

  1. Yes — G704 is a valid/supported gosec rule ID.
    It’s listed in gosec’s rule documentation as “G704 — SSRF via taint analysis” [2]. golangci-lint’s embedded gosec has also added support for the new G70x rules including G704 (via the gosec bump noted in the golangci-lint changelog) [1].

  2. Recommended pattern in golangci-lint v2 to scope gosec suppressions by path/message (instead of global linters.settings.gosec.excludes): use issues.exclude-rules.
    issues.exclude-rules lets you match by path/path-except plus text (message regex) and limit it to linters: [gosec] [3]. Example:

version: "2"

issues:
  exclude-rules:
    - path: ^internal/legacy/
      linters: [gosec]
      text: "G704|SSRF via taint analysis"

For single-call / local suppressions, prefer inline #nosec annotations with the specific rule ID (e.g. #nosec G704) rather than config-wide excludes [4].

Scope gosec suppressions by path/message using issues.exclude-rules instead of global linters.settings.gosec.excludes.

Global excludes for rules like G304 (file inclusion), G306 (file permissions), and G704 (SSRF) weaken repo-wide security guarantees. Use issues.exclude-rules with path and text matchers, or prefer inline #nosec G<rule> annotations at specific false-positive sites.

Example: path-scoped gosec suppressions 
issues:
  exclude-rules:
    - path: ^internal/config/
      linters: [gosec]
      text: "G304|G306"
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.golangci.yml around lines 43 - 49, Replace the global gosec excludes under
linters.settings.gosec.excludes with scoped suppressions using
issues.exclude-rules (or inline `#nosec` annotations) so the suppressions apply
only to specific paths/messages; for each rule currently listed (e.g. G304,
G306, G704 — and optionally G104, G115, G117) add one or more
issues.exclude-rules entries that include a path regex (e.g. ^internal/config/),
linters: [gosec], and a text matcher that targets the rule or false-positive
message, or leave the rule enabled globally and add `#nosec G<rule>` at the
precise false-positive sites in the code (e.g. around config-loading in the
functions that handle file inclusion/permissions/HTTP clients).

revive:
rules:
- name: blank-imports
- name: context-as-argument
- name: dot-imports
- name: error-return
- name: error-strings
- name: error-naming
- name: exported
disabled: true
- name: increment-decrement
- name: var-naming
- name: range
- name: receiver-naming
- name: indent-error-flow
- name: empty-block
- name: superfluous-else
- name: unreachable-code
- name: redefines-builtin-id

exclusions:
rules:
# Standard Go package names are fine for internal packages.
- linters:
- revive
text: "avoid.*package names"
paths:
- vendor
- ".*\\.pb\\.go$"
- ".*\\.pb\\.gw\\.go$"

formatters:
enable:
Expand Down
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@ just check # tidy + lint + test + build
## Documentation

- [Running Apex](docs/running.md) -- setup, configuration, Docker, CLI
- [API Compatibility Policy](docs/api-compat.md) -- JSON-RPC compatibility boundary vs gRPC evolution

## License

Expand Down
Loading
Loading