build: add gosec

.github/workflows/build-test-lint.yml

@@ -25,6 +25,7 @@ jobs:
         run: |-
           go install github.com/segmentio/[email protected]
           go install mvdan.cc/[email protected]
+          go install github.com/securego/gosec/v2/cmd/[email protected]
 
       - name: Build
         run: make build

Makefile

@@ -5,6 +5,7 @@ help: ## Show this help
 
 lint: tidy ## Run linter
 	golines -w -m 79 --base-formatter=gofumpt .
+	gosec ./...
 
 tidy: ## Tidy up dependencies
 	go mod tidy

pkg/database/database.go

@@ -20,7 +20,7 @@ type Entry struct {
 
 // fetchCsv fetches a CSV file from the given URL and returns its records.
 func fetchCsv(url string) ([][]string, error) {
-	resp, err := http.Get(url)
+	resp, err := http.Get(url) // #nosec G107
 	if err != nil {
 		return nil, err
 	}

pkg/schema/reader.go

@@ -31,8 +31,8 @@ func ReadBytes(data []byte) (*Configuration, error) {
 	}
 
 	validate := validator.New()
-	validate.RegisterValidation("duration", isDurationField)
-	validate.RegisterValidation("cidr", isCIDRField)
+	validate.RegisterValidation("duration", isDurationField) // #nosec G104
+	validate.RegisterValidation("cidr", isCIDRField)         // #nosec G104
 
 	if err := validate.Struct(config); err != nil {
 		return nil, err
@@ -52,7 +52,7 @@ func Read(reader io.Reader) (*Configuration, error) {
 
 // ReadFile reads the configuration from the given file.
 func ReadFile(filename string) (*Configuration, error) {
-	data, err := os.ReadFile(filename)
+	data, err := os.ReadFile(filename) // #nosec G304
 	if err != nil {
 		return nil, err
 	}