Reuse installed ginkgo and use cleaner binary check

jorbaum · jorbaum · commit e472868bf735 · 2026-03-03T11:29:54.000+01:00
Also:

* Replace golang.org/x/net/context with context
* Ignore G115
    numOfRoutes is never negative anyway
* Ignore gosec G117
    ClientSecret is not exposed to outside.
* Ignore G704
    URI address is not provided by user but by server-side config.
* Ignore G704 SSRF via taint analysis in tests
    There is no user controlled input
* Prefer nolint over nosec everywhere
diff --git a/scripts/subtests/lint b/scripts/subtests/lint
@@ -5,14 +5,10 @@ set -o pipefail
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
 
-set +e
-golangci_lint_executable=$(which golangci-lint)
-set -e
-if [ -z "${golangci_lint_executable}" ] || [ ! -x "${golangci_lint_executable}" ]; then
+if ! command -v golangci-lint &> /dev/null; then
   go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
 fi
 
 pushd "${SCRIPT_DIR}/../../src" > /dev/null
   golangci-lint run ./...
-popd > /dev/null
-
+popd > /dev/null
diff --git a/scripts/subtests/spec-test b/scripts/subtests/spec-test
@@ -5,10 +5,7 @@ set -o pipefail
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
 
-set +e
-bundler_executable=$(which bundle)
-set -e
-if [ -z "${bundler_executable}" ] || [ ! -x "${bundler_executable}" ]; then
+if ! command -v bundle &> /dev/null; then
   gem install bundler
 fi
 
diff --git a/scripts/subtests/unit-test b/scripts/subtests/unit-test
@@ -11,6 +11,8 @@ if [ "${CI:-false}" = 'false' ]; then
 fi
 
 pushd "${SCRIPT_DIR}/../../src" > /dev/null
-    go run github.com/onsi/ginkgo/v2/ginkgo $flags
-popd > /dev/null
-
+    if ! command -v ginkgo &> /dev/null; then
+      go install github.com/onsi/ginkgo/v2/ginkgo@latest
+    fi
+    ginkgo $flags 
+popd > /dev/null
diff --git a/src/cmd/cf-auth-proxy/config.go b/src/cmd/cf-auth-proxy/config.go
@@ -15,7 +15,7 @@ type CAPI struct {
 
 type UAA struct {
 	ClientID     string `env:"UAA_CLIENT_ID,"`
-	ClientSecret string `env:"UAA_CLIENT_SECRET,"`
+	ClientSecret string `env:"UAA_CLIENT_SECRET,"` //nolint:gosec
 	Addr         string `env:"UAA_ADDR,          required, report"`
 	CAPath       string `env:"UAA_CA_PATH,                 report"`
 }
diff --git a/src/internal/auth/capi_client.go b/src/internal/auth/capi_client.go
@@ -96,7 +96,7 @@ func (c *CAPIClient) IsAuthorized(sourceId string, clientToken string) bool {
 }
 
 func (c *CAPIClient) HasApp(sourceID, authToken string) bool {
-	req, err := http.NewRequest(http.MethodGet, c.addr+"/v3/apps/"+sourceID, nil)
+	req, err := http.NewRequest(http.MethodGet, c.addr+"/v3/apps/"+sourceID, nil) //nolint:gosec
 	if err != nil {
 		c.log.Printf("failed to build authorize log access request: %s", err)
 		return false
@@ -130,7 +130,7 @@ func (c *CAPIClient) GetRelatedSourceIds(appNames []string, authToken string) ma
 		return map[string][]string{}
 	}
 
-	req, err := http.NewRequest(http.MethodGet, c.addr+"/v3/apps", nil)
+	req, err := http.NewRequest(http.MethodGet, c.addr+"/v3/apps", nil) //nolint:gosec
 	if err != nil {
 		c.log.Printf("failed to build app list request: %s", err)
 		return map[string][]string{}
diff --git a/src/internal/cache/log_cache.go b/src/internal/cache/log_cache.go
@@ -1,6 +1,7 @@
 package cache
 
 import (
+	"context"
 	"log"
 	"net"
 	"strconv"
@@ -9,7 +10,6 @@ import (
 
 	metrics "code.cloudfoundry.org/go-metric-registry"
 
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 
diff --git a/src/internal/cfauthproxy/cf_auth_proxy_test.go b/src/internal/cfauthproxy/cf_auth_proxy_test.go
@@ -287,7 +287,7 @@ func makeTLSReq(addr string) (*http.Response, error) {
 	}
 	client := &http.Client{Transport: tr}
 
-	return client.Do(req)
+	return client.Do(req) //nolint:gosec
 }
 
 func makeReq(addr string) (*http.Response, error) {
@@ -296,5 +296,5 @@ func makeReq(addr string) (*http.Response, error) {
 
 	client := &http.Client{}
 
-	return client.Do(req)
+	return client.Do(req) //nolint:gosec
 }
diff --git a/src/internal/gateway/gateway.go b/src/internal/gateway/gateway.go
@@ -1,6 +1,7 @@
 package gateway
 
 import (
+	"context"
 	"fmt"
 	"io"
 	"log"
@@ -10,7 +11,6 @@ import (
 
 	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
 	"github.com/shirou/gopsutil/v4/host"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/encoding/protojson"
@@ -187,7 +187,7 @@ func (g *Gateway) handleInfoEndpoint(w http.ResponseWriter, r *http.Request) {
 
 func uptimeInSeconds() int64 {
 	hostStats, _ := host.Info()
-	return int64(hostStats.Uptime) //#nosec G115
+	return int64(hostStats.Uptime) //nolint:gosec
 }
 
 type errorBody struct {
diff --git a/src/internal/gateway/gateway_test.go b/src/internal/gateway/gateway_test.go
@@ -226,7 +226,7 @@ func makeTLSReq(addr string) (*http.Response, error) {
 	}
 	client := &http.Client{Transport: tr}
 
-	return client.Do(req)
+	return client.Do(req) // nolint:gosec
 }
 
 func makeReq(addr string) (*http.Response, error) {
@@ -235,5 +235,5 @@ func makeReq(addr string) (*http.Response, error) {
 
 	client := &http.Client{}
 
-	return client.Do(req)
+	return client.Do(req) // nolint:gosec
 }
diff --git a/src/internal/nozzle/nozzle.go b/src/internal/nozzle/nozzle.go
@@ -1,6 +1,7 @@
 package nozzle
 
 import (
+	"context"
 	"log"
 	"runtime"
 	"time"
@@ -11,7 +12,6 @@ import (
 	diodes "code.cloudfoundry.org/go-diodes"
 	"code.cloudfoundry.org/go-log-cache/v3/rpc/logcache_v1"
 	"code.cloudfoundry.org/go-loggregator/v10/rpc/loggregator_v2"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 )
@@ -177,7 +177,7 @@ func (n *Nozzle) envelopeWriter(ch chan []*loggregator_v2.Envelope, client logca
 	for {
 		envelopes := <-ch
 
-		ctx, _ := context.WithTimeout(context.Background(), 3*time.Second)
+		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
 		_, err := client.Send(ctx, &logcache_v1.SendRequest{
 			Envelopes: &loggregator_v2.EnvelopeBatch{
 				Batch: envelopes,
@@ -186,10 +186,12 @@ func (n *Nozzle) envelopeWriter(ch chan []*loggregator_v2.Envelope, client logca
 
 		if err != nil {
 			n.errCounter.Add(1)
+			cancel()
 			continue
 		}
 
 		n.egressCounter.Add(float64(len(envelopes)))
+		cancel()
 	}
 }
 
diff --git a/src/internal/nozzle/nozzle_test.go b/src/internal/nozzle/nozzle_test.go
@@ -1,6 +1,7 @@
 package nozzle_test
 
 import (
+	"context"
 	"log"
 	"sync"
 
@@ -9,7 +10,6 @@ import (
 	"code.cloudfoundry.org/go-loggregator/v10"
 	"code.cloudfoundry.org/go-loggregator/v10/rpc/loggregator_v2"
 	. "code.cloudfoundry.org/log-cache/internal/nozzle"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/credentials/insecure"
diff --git a/src/internal/routing/batched_ingress_client.go b/src/internal/routing/batched_ingress_client.go
@@ -1,6 +1,7 @@
 package routing
 
 import (
+	"context"
 	"log"
 	"time"
 
@@ -10,7 +11,6 @@ import (
 	diodes "code.cloudfoundry.org/go-diodes"
 	rpc "code.cloudfoundry.org/go-log-cache/v3/rpc/logcache_v1"
 	"code.cloudfoundry.org/go-loggregator/v10/rpc/loggregator_v2"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 )
 
@@ -96,7 +96,8 @@ func (b *BatchedIngressClient) write(batch []interface{}) {
 		e = append(e, i.(*loggregator_v2.Envelope))
 	}
 
-	ctx, _ := context.WithTimeout(context.Background(), 3*time.Second)
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
 	_, err := b.c.Send(ctx, &rpc.SendRequest{
 		LocalOnly: b.localOnly,
 		Envelopes: &loggregator_v2.EnvelopeBatch{Batch: e},
diff --git a/src/internal/routing/batched_ingress_client_test.go b/src/internal/routing/batched_ingress_client_test.go
@@ -1,6 +1,7 @@
 package routing_test
 
 import (
+	"context"
 	"io"
 	"log"
 	"time"
@@ -11,7 +12,6 @@ import (
 	"code.cloudfoundry.org/go-loggregator/v10/rpc/loggregator_v2"
 	metrics "code.cloudfoundry.org/go-metric-registry"
 	"code.cloudfoundry.org/log-cache/internal/routing"
-	"golang.org/x/net/context"
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
diff --git a/src/internal/routing/local_store_reader.go b/src/internal/routing/local_store_reader.go
@@ -1,13 +1,13 @@
 package routing
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"time"
 
 	"code.cloudfoundry.org/go-log-cache/v3/rpc/logcache_v1"
 	"code.cloudfoundry.org/go-loggregator/v10/rpc/loggregator_v2"
-	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 )
 
diff --git a/src/internal/routing/local_store_reader_test.go b/src/internal/routing/local_store_reader_test.go
@@ -1,13 +1,13 @@
 package routing_test
 
 import (
+	"context"
 	"regexp"
 	"time"
 
 	"code.cloudfoundry.org/go-log-cache/v3/rpc/logcache_v1"
 	"code.cloudfoundry.org/go-loggregator/v10/rpc/loggregator_v2"
 	"code.cloudfoundry.org/log-cache/internal/routing"
-	"golang.org/x/net/context"
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
diff --git a/src/internal/routing/routing_table.go b/src/internal/routing/routing_table.go
@@ -47,7 +47,7 @@ func (t *RoutingTable) Lookup(item string) []int {
 	node := t.hasher.Hash(hashValue)
 
 	var result []int
-	var replicationFactor = int(t.replicationFactor) //#nosec G115
+	var replicationFactor = int(t.replicationFactor) //nolint:gosec
 	for n := 0; n < replicationFactor; n++ {
 		result = append(result, (node+n*replicationFactor)%len(t.addresses))
 	}
diff --git a/src/internal/routing/static_lookup.go b/src/internal/routing/static_lookup.go
@@ -23,8 +23,8 @@ func NewStaticLookup(numOfRoutes int, hasher func(string) uint64) *StaticLookup
 
 	// NOTE: 18446744073709551615 is 0xFFFFFFFFFFFFFFFF or the max value of a
 	// uint64.
-	x := (18446744073709551615 / uint64(numOfRoutes))
-	for i := uint64(0); i < uint64(numOfRoutes); i++ {
+	x := (18446744073709551615 / uint64(numOfRoutes))  //nolint:gosec
+	for i := uint64(0); i < uint64(numOfRoutes); i++ { //nolint:gosec
 		t.Put(i*x, i)
 	}
 
@@ -39,5 +39,5 @@ func NewStaticLookup(numOfRoutes int, hasher func(string) uint64) *StaticLookup
 func (l *StaticLookup) Lookup(sourceID string) int {
 	h := l.hash(sourceID)
 	n, _ := l.t.Floor(h)
-	return int(n.Value.(uint64)) //#nosec G115
+	return int(n.Value.(uint64)) //nolint:gosec
 }
diff --git a/src/internal/syslog/server.go b/src/internal/syslog/server.go
@@ -1,10 +1,15 @@
 package syslog
 
 import (
+	"context"
 	"crypto/tls"
 	"errors"
 	"fmt"
 	"log"
+	"net"
+	"strconv"
+	"strings"
+	"sync"
 	"time"
 
 	"code.cloudfoundry.org/go-loggregator/v10"
@@ -15,13 +20,6 @@ import (
 	"github.com/leodido/go-syslog/v4/nontransparent"
 	"github.com/leodido/go-syslog/v4/octetcounting"
 	"github.com/leodido/go-syslog/v4/rfc5424"
-
-	"net"
-	"strconv"
-	"strings"
-	"sync"
-
-	"golang.org/x/net/context"
 )
 
 type Server struct {
@@ -269,7 +267,7 @@ func (s *Server) convertMessage(env *loggregator_v2.Envelope, msg *rfc5424.Syslo
 	env.Message = &loggregator_v2.Envelope_Log{
 		Log: &loggregator_v2.Log{
 			Payload: []byte(payload),
-			Type:    s.typeFromPriority(int(*msg.Priority)), //#nosec G115
+			Type:    s.typeFromPriority(int(*msg.Priority)), //nolint:gosec
 		},
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -15,7 +15,7 @@ type CAPI struct {`
`15`	`15`
`16`	`16`	`type UAA struct {`
`17`	`17`	ClientID string `env:"UAA_CLIENT_ID,"`
`18`		- ClientSecret string `env:"UAA_CLIENT_SECRET,"`
	`18`	+ ClientSecret string `env:"UAA_CLIENT_SECRET,"` //nolint:gosec
`19`	`19`	Addr string `env:"UAA_ADDR, required, report"`
`20`	`20`	CAPath string `env:"UAA_CA_PATH, report"`
`21`	`21`	`}`
Original file line number	Diff line number	Diff line change
`@@ -287,7 +287,7 @@ func makeTLSReq(addr string) (*http.Response, error) {`
`287`	`287`	`}`
`288`	`288`	`client := &http.Client{Transport: tr}`
`289`	`289`
`290`		`- return client.Do(req)`
	`290`	`+ return client.Do(req) //nolint:gosec`
`291`	`291`	`}`
`292`	`292`
`293`	`293`	`func makeReq(addr string) (*http.Response, error) {`
`@@ -296,5 +296,5 @@ func makeReq(addr string) (*http.Response, error) {`
`296`	`296`
`297`	`297`	`client := &http.Client{}`
`298`	`298`
`299`		`- return client.Do(req)`
	`299`	`+ return client.Do(req) //nolint:gosec`
`300`	`300`	`}`
Original file line number	Diff line number	Diff line change
`@@ -226,7 +226,7 @@ func makeTLSReq(addr string) (*http.Response, error) {`
`226`	`226`	`}`
`227`	`227`	`client := &http.Client{Transport: tr}`
`228`	`228`
`229`		`- return client.Do(req)`
	`229`	`+ return client.Do(req) // nolint:gosec`
`230`	`230`	`}`
`231`	`231`
`232`	`232`	`func makeReq(addr string) (*http.Response, error) {`
`@@ -235,5 +235,5 @@ func makeReq(addr string) (*http.Response, error) {`
`235`	`235`
`236`	`236`	`client := &http.Client{}`
`237`	`237`
`238`		`- return client.Do(req)`
	`238`	`+ return client.Do(req) // nolint:gosec`
`239`	`239`	`}`