Fix gosec linter issues and upgrade go.step.sm/crypto to v0.76.2

hslatman · hslatman · commit 8b97ef5cacf3 · 2026-02-24T13:51:00.000+01:00
diff --git a/command/api/token/create.go b/command/api/token/create.go
@@ -120,7 +120,7 @@ func createAction(ctx *cli.Context) (err error) {
 	client := http.Client{
 		Transport: transport,
 	}
-	resp, err := client.Do(post)
+	resp, err := client.Do(post) // #nosec G704 -- request depends on configuration
 	if err != nil {
 		return err
 	}
diff --git a/command/ca/acme/eab/list.go b/command/ca/acme/eab/list.go
@@ -5,6 +5,7 @@ import (
 	"io"
 	"os"
 	"os/exec"
+	"strings"
 
 	"github.com/pkg/errors"
 	"github.com/urfave/cli"
@@ -99,8 +100,16 @@ func listAction(ctx *cli.Context) (err error) {
 
 	// prepare the $PAGER command to run when not disabled and when available
 	pager := os.Getenv("PAGER")
+	if strings.ContainsAny(pager, " \t\n;&|<>") {
+		return errors.New("invalid PAGER environment value")
+	}
+
+	if _, err := exec.LookPath(pager); err != nil {
+		return fmt.Errorf("invalid PAGER environment value: %w", err)
+	}
+
 	if usePager && pager != "" {
-		cmd = exec.Command(pager)
+		cmd = exec.Command(pager) // #nosec G702 -- $PAGER is intended to be provided by users; basic validation applied
 		var err error
 		out, err = cmd.StdinPipe()
 		if err != nil {
diff --git a/command/ca/provisioner/add.go b/command/ca/provisioner/add.go
@@ -28,7 +28,7 @@ import (
 )
 
 func addCommand() cli.Command {
-	return cli.Command{
+	return cli.Command{ // #nosec G101 -- Google OIDC example values
 		Name:   "add",
 		Action: cli.ActionFunc(addAction),
 		Usage:  "add a provisioner",
diff --git a/command/certificate/verify.go b/command/certificate/verify.go
@@ -250,7 +250,6 @@ func verifyAction(ctx *cli.Context) error {
 
 	switch {
 	case (verifyCRL || verifyOCSP) && roots != "":
-		//nolint:gosec // using default configuration for 3rd party endpoints
 		tlsConfig := &tls.Config{
 			RootCAs: rootPool,
 		}
@@ -389,7 +388,7 @@ func VerifyOCSPEndpoint(endpoint string, cert, issuer *x509.Certificate, httpCli
 		return false, errors.Errorf("error contacting OCSP server: %s", endpoint)
 	}
 	httpReq.Header.Add("Content-Type", "application/ocsp-request")
-	httpResp, err := httpClient.Do(httpReq)
+	httpResp, err := httpClient.Do(httpReq) // #nosec G704 -- request relies on values from certificate or intentionally provided by user
 	if err != nil {
 		return false, errors.Errorf("error contacting OCSP server: %s", endpoint)
 	}
diff --git a/command/crypto/jwk/keyset.go b/command/crypto/jwk/keyset.go
@@ -234,7 +234,7 @@ func rwLockKeySet(filename string) (jwks *jose.JSONWebKeySet, writeFunc func(boo
 		return
 	}
 
-	fd := int(f.Fd())
+	fd := int(f.Fd()) // #nosec G115 -- uintptr comes from file descriptor
 
 	// non-blocking exclusive lock
 	err = sysutils.FileLock(fd)
diff --git a/command/crypto/winpe/winpe.go b/command/crypto/winpe/winpe.go
@@ -67,7 +67,7 @@ func extractPEAction(ctx *cli.Context) error {
 }
 
 func extractPE(filename string) error {
-	file, err := os.Open(filename)
+	file, err := os.Open(filename) // #nosec G703 -- file to open intentionally relies on user configuration
 	if err != nil {
 		return errors.Wrapf(err, "error opening %s", filename)
 	}
diff --git a/command/oauth/cmd.go b/command/oauth/cmd.go
@@ -66,9 +66,9 @@ const (
 )
 
 type token struct {
-	AccessToken  string `json:"access_token"`
+	AccessToken  string `json:"access_token"` // #nosec G117 -- JSON property
 	IDToken      string `json:"id_token"`
-	RefreshToken string `json:"refresh_token"`
+	RefreshToken string `json:"refresh_token"` // #nosec G117 -- JSON property
 	ExpiresIn    int    `json:"expires_in"`
 	TokenType    string `json:"token_type"`
 	Err          string `json:"error,omitempty"`
@@ -571,13 +571,13 @@ type endpoint struct {
 }
 
 var knownProviders = map[string]endpoint{
-	"google": {
+	"google": { // #nosec G101 -- no credentials; just well-known configuration values
 		authorization:       "https://accounts.google.com/o/oauth2/v2/auth",
 		deviceAuthorization: "https://oauth2.googleapis.com/device/code",
 		token:               "https://www.googleapis.com/oauth2/v4/token",
 		userInfo:            "https://www.googleapis.com/oauth2/v3/userinfo",
 	},
-	"github": {
+	"github": { // #nosec G101 -- no credentials; just well-known configuration values
 		authorization:       "https://github.com/login/oauth/authorize",
 		deviceAuthorization: "https://github.com/login/device/code",
 		token:               "https://github.com/login/oauth/access_token",
@@ -712,7 +712,7 @@ func disco(provider string) (map[string]interface{}, error) {
 // application/json", without this header GitHub will use
 // application/x-www-form-urlencoded.
 func postForm(rawurl string, data url.Values) (*http.Response, error) {
-	req, err := http.NewRequest("POST", rawurl, strings.NewReader(data.Encode()))
+	req, err := http.NewRequest("POST", rawurl, strings.NewReader(data.Encode())) // #nosec G704 -- request intentionally relies on user data
 	if err != nil {
 		return nil, fmt.Errorf("create POST %s request failed: %w", rawurl, err)
 	}
@@ -722,7 +722,7 @@ func postForm(rawurl string, data url.Values) (*http.Response, error) {
 
 	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 	req.Header.Set("Accept", "application/json")
-	return http.DefaultClient.Do(req)
+	return http.DefaultClient.Do(req) // #nosec G704 -- request intentionally relies on user configuration
 }
 
 // NewServer creates http server
@@ -1106,7 +1106,7 @@ func (o *oauth) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 
 	code, state := q.Get("code"), q.Get("state")
 	if code == "" || state == "" {
-		fmt.Fprintf(os.Stderr, "Invalid request received: http://%s%s\n", req.RemoteAddr, req.URL.String())
+		fmt.Fprintf(os.Stderr, "Invalid request received: http://%s%s\n", req.RemoteAddr, req.URL.String()) // #nosec G705 -- terminal output
 		fmt.Fprintf(os.Stderr, "You may have an app or browser plugin that needs to be turned off\n")
 		http.Error(w, "400 bad request", http.StatusBadRequest)
 		return
diff --git a/exec/exec.go b/exec/exec.go
@@ -79,7 +79,7 @@ func RunWithPid(pidFile, name string, arg ...string) {
 	cmd, exitCh, err := run(name, arg...)
 	if err != nil {
 		f.Close()
-		os.Remove(f.Name())
+		_ = os.Remove(f.Name()) // #nosec G703 -- file does not depend on user configuration
 		errorAndExit(name, err)
 	}
 
@@ -94,7 +94,7 @@ func RunWithPid(pidFile, name string, arg ...string) {
 	}
 
 	// clean, exit and wait until os.Exit
-	os.Remove(f.Name())
+	_ = os.Remove(f.Name()) // #nosec G703 -- file does not depend on user configuration
 	exitCh <- getExitStatus(cmd)
 	exitCh <- 0
 }
diff --git a/internal/cmd/root.go b/internal/cmd/root.go
@@ -163,7 +163,7 @@ func panicHandler() {
 
 		fmt.Fprintln(os.Stderr, "Something unexpected happened.")
 		fmt.Fprintln(os.Stderr, "If you want to help us debug the problem, please run:")
-		fmt.Fprintf(os.Stderr, "STEPDEBUG=1 %s\n", strings.Join(os.Args, " "))
+		fmt.Fprintf(os.Stderr, "STEPDEBUG=1 %q\n", strings.Join(os.Args, " ")) // #nosec G705 -- terminal output
 		fmt.Fprintln(os.Stderr, "and send the output to info@smallstep.com")
 		os.Exit(2)
 	}
diff --git a/internal/plugin/plugin.go b/internal/plugin/plugin.go
@@ -38,7 +38,7 @@ func LookPath(name string) (string, error) {
 		}
 		for _, ext := range exts {
 			path := filepath.Join(step.BasePath(), "plugins", fileName+ext)
-			if _, err := os.Stat(path); err == nil {
+			if _, err := os.Stat(path); err == nil { // #nosec G703 -- path to stat intentionally relies on (partial) user configuration
 				return path, nil
 			}
 		}
diff --git a/internal/sshutil/agent_unix.go b/internal/sshutil/agent_unix.go
@@ -14,7 +14,7 @@ import (
 // to the agent.
 func dialAgent() (*Agent, error) {
 	socket := os.Getenv("SSH_AUTH_SOCK")
-	conn, err := net.Dial("unix", socket)
+	conn, err := net.Dial("unix", socket) // #nosec G704 -- SSH_AUTH_SOCK points to a local Unix domain socket path
 	if err != nil {
 		return nil, errors.Wrap(err, "error connecting with ssh-agent")
 	}
diff --git a/internal/sshutil/agent_windows.go b/internal/sshutil/agent_windows.go
@@ -17,7 +17,7 @@ func dialAgent() (*Agent, error) {
 	// Override the default windows openssh-ssh-agent pipe
 	if socket := os.Getenv("SSH_AUTH_SOCK"); socket != "" {
 		// Attempt unix sockets for environments like cygwin.
-		if conn, err := net.Dial("unix", socket); err == nil {
+		if conn, err := net.Dial("unix", socket); err == nil { // #nosec G704 -- SSH_AUTH_SOCK points to a local Unix domain socket path
 			return &Agent{
 				ExtendedAgent: agent.NewClient(conn),
 				Conn:          conn,
diff --git a/internal/sshutil/pipe.go b/internal/sshutil/pipe.go
@@ -38,7 +38,7 @@ var (
 )
 
 func readWindowsPipeNameFrom(configFile string) (pipeName string) {
-	file, err := os.Open(configFile)
+	file, err := os.Open(configFile) // #nosec G703 -- intentionally reading from user configuration
 	if err == nil {
 		sc := bufio.NewScanner(file)
 		for sc.Scan() {
diff --git a/internal/sshutil/shell.go b/internal/sshutil/shell.go
@@ -179,7 +179,7 @@ func (s *Shell) RemoteShell() error {
 	defer session.Close()
 
 	var fallback bool
-	if fd := int(os.Stdin.Fd()); term.IsTerminal(fd) {
+	if fd := int(os.Stdin.Fd()); term.IsTerminal(fd) { // #nosec G115 -- uintptr comes from file descriptor
 		// Put terminal in raw mode
 		if originalState, err := term.MakeRaw(fd); err != nil {
 			fallback = true
diff --git a/pkg/bcrypt_pbkdf/bcrypt_pbkdf.go b/pkg/bcrypt_pbkdf/bcrypt_pbkdf.go
@@ -92,6 +92,6 @@ func bcryptHash(out, shapass, shasalt []byte) {
 	}
 	// Swap bytes due to different endianness.
 	for i := 0; i < 32; i += 4 {
-		out[i+3], out[i+2], out[i+1], out[i] = out[i], out[i+1], out[i+2], out[i+3]
+		out[i+3], out[i+2], out[i+1], out[i] = out[i], out[i+1], out[i+2], out[i+3] // #nosec G602 -- loop condition guarantees this doesn't go out of range
 	}
 }
diff --git a/token/parse.go b/token/parse.go
@@ -53,7 +53,7 @@ type Payload struct {
 	Version                 interface{}       `json:"ver"`
 	XMSMirID                string            `json:"xms_mirid"`
 	K8sSANamespace          string            `json:"kubernetes.io/serviceaccount/namespace,omitempty"`
-	K8sSASecretName         string            `json:"kubernetes.io/serviceaccount/secret.name,omitempty"`
+	K8sSASecretName         string            `json:"kubernetes.io/serviceaccount/secret.name,omitempty"` // #nosec G117 -- JSON property
 	K8sSAServiceAccountName string            `json:"kubernetes.io/serviceaccount/service-account.name,omitempty"`
 	K8sSAServiceAccountUID  string            `json:"kubernetes.io/serviceaccount/service-account.uid,omitempty"`
 	Google                  *GCPGooglePayload `json:"google"` // GCP token claims
diff --git a/utils/cautils/tpm.go b/utils/cautils/tpm.go
@@ -509,18 +509,18 @@ func (ac *attestationClient) performAttestation(ctx context.Context, t *tpm.TPM,
 
 	encryptedCredentials := tpm.EncryptedCredential{
 		Credential: attResp.Credential,
-		Secret:     attResp.Secret,
+		Secret:     attResp.EncryptedSecret,
 	}
 
 	// activate the credential with the TPM
-	secret, err := ak.ActivateCredential(ctx, encryptedCredentials)
+	decryptedSecret, err := ak.ActivateCredential(ctx, encryptedCredentials)
 	if err != nil {
 		return nil, fmt.Errorf("failed activating credential: %w", err)
 	}
 
-	secretResp, err := ac.secret(ctx, secret)
+	secretResp, err := ac.verifyDecryptedSecret(ctx, decryptedSecret)
 	if err != nil {
-		return nil, fmt.Errorf("failed validating secret: %w", err)
+		return nil, fmt.Errorf("failed validating decrypted secret: %w", err)
 	}
 
 	akChain := make([]*x509.Certificate, len(secretResp.CertificateChain))
@@ -559,8 +559,8 @@ type attestationRequest struct {
 }
 
 type attestationResponse struct {
-	Credential []byte `json:"credential"`
-	Secret     []byte `json:"secret"` // encrypted secret
+	Credential      []byte `json:"credential"`
+	EncryptedSecret []byte `json:"secret"` // #nosec G117 -- JSON property carrying encrypted secret
 }
 
 // attest performs the HTTP POST request to the `/attest` endpoint of the
@@ -616,7 +616,7 @@ func (ac *attestationClient) attest(ctx context.Context, info *tpm.Info, eks []*
 		return nil, fmt.Errorf("failed creating POST http request for %q: %w", attestURL, err)
 	}
 
-	resp, err := ac.client.Do(req)
+	resp, err := ac.client.Do(req) // #nosec G704 -- request intentionally relies on user configuration
 	if err != nil {
 		return nil, fmt.Errorf("failed performing attestation request with Attestation CA %q: %w", attestURL, err)
 	}
@@ -635,18 +635,18 @@ func (ac *attestationClient) attest(ctx context.Context, info *tpm.Info, eks []*
 }
 
 type secretRequest struct {
-	Secret []byte `json:"secret"` // decrypted secret
+	DecryptedSecret []byte `json:"secret"` // #nosec G117 -- JSON property carrying decrypted secret
 }
 
 type secretResponse struct {
 	CertificateChain [][]byte `json:"chain"`
 }
 
-// secret performs the HTTP POST request to the `/secret` endpoint of the
-// Attestation CA.
-func (ac *attestationClient) secret(ctx context.Context, secret []byte) (*secretResponse, error) {
+// verifyDecryptedSecret performs the HTTP POST request to the `/secret`
+// endpoint of the Attestation CA.
+func (ac *attestationClient) verifyDecryptedSecret(ctx context.Context, secret []byte) (*secretResponse, error) {
 	sr := secretRequest{
-		Secret: secret,
+		DecryptedSecret: secret,
 	}
 
 	body, err := json.Marshal(sr)
@@ -660,7 +660,7 @@ func (ac *attestationClient) secret(ctx context.Context, secret []byte) (*secret
 		return nil, fmt.Errorf("failed creating POST http request for %q: %w", secretURL, err)
 	}
 
-	resp, err := ac.client.Do(req)
+	resp, err := ac.client.Do(req) // #nosec G704 -- request intentionally relies on user configuration
 	if err != nil {
 		return nil, fmt.Errorf("failed performing secret request with attestation CA %q: %w", secretURL, err)
 	}
diff --git a/utils/read.go b/utils/read.go
@@ -53,7 +53,7 @@ func ReadString(r io.Reader) (string, error) {
 // ReadPasswordFromFile reads and returns the password from the given filename.
 // The contents of the file will be trimmed at the right.
 func ReadPasswordFromFile(filename string) ([]byte, error) {
-	password, err := os.ReadFile(filename)
+	password, err := os.ReadFile(filename) // #nosec G703 -- file intended to be provided by user
 	if err != nil {
 		return nil, errs.FileError(err, filename)
 	}
@@ -94,7 +94,7 @@ func ReadFile(name string) (b []byte, err error) {
 		b, err = io.ReadAll(stdin)
 	} else {
 		var contents []byte
-		contents, err = os.ReadFile(name)
+		contents, err = os.ReadFile(name) // #nosec G703 -- file intended to be provided by user
 		if err != nil {
 			return nil, errs.FileError(err, name)
 		}

Original file line number	Diff line number	Diff line change
`@@ -120,7 +120,7 @@ func createAction(ctx *cli.Context) (err error) {`
`120`	`120`	`client := http.Client{`
`121`	`121`	`Transport: transport,`
`122`	`122`	`}`
`123`		`- resp, err := client.Do(post)`
	`123`	`+ resp, err := client.Do(post) // #nosec G704 -- request depends on configuration`
`124`	`124`	`if err != nil {`
`125`	`125`	`return err`
`126`	`126`	`}`
Original file line number	Diff line number	Diff line change
`@@ -28,7 +28,7 @@ import (`
`28`	`28`	`)`
`29`	`29`
`30`	`30`	`func addCommand() cli.Command {`
`31`		`- return cli.Command{`
	`31`	`+ return cli.Command{ // #nosec G101 -- Google OIDC example values`
`32`	`32`	`Name: "add",`
`33`	`33`	`Action: cli.ActionFunc(addAction),`
`34`	`34`	`Usage: "add a provisioner",`
Original file line number	Diff line number	Diff line change
`@@ -250,7 +250,6 @@ func verifyAction(ctx *cli.Context) error {`
`250`	`250`
`251`	`251`	`switch {`
`252`	`252`	`case (verifyCRL \|\| verifyOCSP) && roots != "":`
`253`		`- //nolint:gosec // using default configuration for 3rd party endpoints`
`254`	`253`	`tlsConfig := &tls.Config{`
`255`	`254`	`RootCAs: rootPool,`
`256`	`255`	`}`
`@@ -389,7 +388,7 @@ func VerifyOCSPEndpoint(endpoint string, cert, issuer *x509.Certificate, httpCli`
`389`	`388`	`return false, errors.Errorf("error contacting OCSP server: %s", endpoint)`
`390`	`389`	`}`
`391`	`390`	`httpReq.Header.Add("Content-Type", "application/ocsp-request")`
`392`		`- httpResp, err := httpClient.Do(httpReq)`
	`391`	`+ httpResp, err := httpClient.Do(httpReq) // #nosec G704 -- request relies on values from certificate or intentionally provided by user`
`393`	`392`	`if err != nil {`
`394`	`393`	`return false, errors.Errorf("error contacting OCSP server: %s", endpoint)`
`395`	`394`	`}`
Original file line number	Diff line number	Diff line change
`@@ -234,7 +234,7 @@ func rwLockKeySet(filename string) (jwks *jose.JSONWebKeySet, writeFunc func(boo`
`234`	`234`	`return`
`235`	`235`	`}`
`236`	`236`
`237`		`- fd := int(f.Fd())`
	`237`	`+ fd := int(f.Fd()) // #nosec G115 -- uintptr comes from file descriptor`
`238`	`238`
`239`	`239`	`// non-blocking exclusive lock`
`240`	`240`	`err = sysutils.FileLock(fd)`
Original file line number	Diff line number	Diff line change
`@@ -67,7 +67,7 @@ func extractPEAction(ctx *cli.Context) error {`
`67`	`67`	`}`
`68`	`68`
`69`	`69`	`func extractPE(filename string) error {`
`70`		`- file, err := os.Open(filename)`
	`70`	`+ file, err := os.Open(filename) // #nosec G703 -- file to open intentionally relies on user configuration`
`71`	`71`	`if err != nil {`
`72`	`72`	`return errors.Wrapf(err, "error opening %s", filename)`
`73`	`73`	`}`
Original file line number	Diff line number	Diff line change
`@@ -79,7 +79,7 @@ func RunWithPid(pidFile, name string, arg ...string) {`
`79`	`79`	`cmd, exitCh, err := run(name, arg...)`
`80`	`80`	`if err != nil {`
`81`	`81`	`f.Close()`
`82`		`- os.Remove(f.Name())`
	`82`	`+ _ = os.Remove(f.Name()) // #nosec G703 -- file does not depend on user configuration`
`83`	`83`	`errorAndExit(name, err)`
`84`	`84`	`}`
`85`	`85`
`@@ -94,7 +94,7 @@ func RunWithPid(pidFile, name string, arg ...string) {`
`94`	`94`	`}`
`95`	`95`
`96`	`96`	`// clean, exit and wait until os.Exit`
`97`		`- os.Remove(f.Name())`
	`97`	`+ _ = os.Remove(f.Name()) // #nosec G703 -- file does not depend on user configuration`
`98`	`98`	`exitCh <- getExitStatus(cmd)`
`99`	`99`	`exitCh <- 0`
`100`	`100`	`}`
Original file line number	Diff line number	Diff line change
`@@ -163,7 +163,7 @@ func panicHandler() {`
`163`	`163`
`164`	`164`	`fmt.Fprintln(os.Stderr, "Something unexpected happened.")`
`165`	`165`	`fmt.Fprintln(os.Stderr, "If you want to help us debug the problem, please run:")`
`166`		`- fmt.Fprintf(os.Stderr, "STEPDEBUG=1 %s\n", strings.Join(os.Args, " "))`
	`166`	`+ fmt.Fprintf(os.Stderr, "STEPDEBUG=1 %q\n", strings.Join(os.Args, " ")) // #nosec G705 -- terminal output`
`167`	`167`	`fmt.Fprintln(os.Stderr, "and send the output to info@smallstep.com")`
`168`	`168`	`os.Exit(2)`
`169`	`169`	`}`
Original file line number	Diff line number	Diff line change
`@@ -38,7 +38,7 @@ func LookPath(name string) (string, error) {`
`38`	`38`	`}`
`39`	`39`	`for _, ext := range exts {`
`40`	`40`	`path := filepath.Join(step.BasePath(), "plugins", fileName+ext)`
`41`		`- if _, err := os.Stat(path); err == nil {`
	`41`	`+ if _, err := os.Stat(path); err == nil { // #nosec G703 -- path to stat intentionally relies on (partial) user configuration`
`42`	`42`	`return path, nil`
`43`	`43`	`}`
`44`	`44`	`}`