Research digest: gosec sweep — per-finding fix rationale¶

• Date: 2026-06-01
• Author: lusoris (with Claude Code agent)
• Companion ADR: ADR-0983
• Tool: gosec v2.21.4 (commit aabb)

Scan command¶

# Source-truth scan (used by go-ci.yml + make lint-go)
gosec -exclude-generated ./...

# Audit scan (includes cgo + protoc-generated, surfaces context-only noise)
gosec ./...

Raw counts¶

* The post-sweep G103 (4) and G115 (6) findings live in gen/go/*.pb.go (protoc-generated) and the cgo trampoline cache for pkg/libvmaf. Both are excluded from the CI gate via gosec -exclude-generated. Source files hand-authored on the fork carry zero findings.

Per-finding triage¶

G104 — unhandled error (1)¶

G202 — SQL string concatenation (1)¶

G204 — subprocess with variable (19)¶

All G204 findings are variants on "the subprocess command path / arg is a named variable rather than a string literal." gosec cannot prove the variable is safe without help. Every finding was triaged against the fork's libvmaf.ValidatePath allowlist + the const-binary-name patterns.

G301 / G306 — file permissions (2)¶

G304 — file inclusion via variable (5)¶

G115 — integer overflow (6, all cgo cache)¶

All six G115 findings live in the cgo cache for pkg/libvmaf/direct.go (_cgo* generated trampoline). The casts are:

• C.enum_VmafPixelFormat(req.PixFmt) — req.PixFmt is an exported enum constrained to {PixFmtYUV420P, PixFmtYUV422P, PixFmtYUV444P} by the ParsePixFmt helper; cannot overflow uint32.
• C.uint(req.BitDepth) — BitDepth validated to {8, 10, 12} by frameBytes.
• C.uint(req.Width) / C.uint(req.Height) — bounded to libvmaf-supported geometry (≤ 16384) at the schema layer.
• C.uint(frameIdx-1) — frameIdx was just incremented from zero in the outer loop; the frameIdx == 0 guard above the call ensures the subtraction is safe.

These are not maintainable by hand (cgo regenerates the trampoline on every build). Excluded via -exclude-generated.

G103 — unsafe.Slice (4, all protoc-generated)¶

Lines 848 and 910 of gen/go/vmafx.pb.go are the standard protoc-gen-go output for compressing the embedded FileDescriptorProto. Mechanically identical across every protobuf-generated Go file in the ecosystem. Excluded via -exclude-generated.

CI integration¶

# .github/workflows/go-ci.yml (post-sweep)
- name: Install gosec
  run: go install github.com/securego/gosec/v2/cmd/gosec@v2.21.4

- name: gosec (exclude generated)
  run: gosec -exclude-generated -quiet ./...

Plus the matching Makefile target:

lint-go:
    @command -v gosec >/dev/null || { ... skip ... ; }
    @gosec -exclude-generated -quiet ./...

lint-go is now a phase of the top-level make lint, alongside lint-c, lint-py, lint-sh, lint-md.

Regression test¶

cmd/vmafx-mcp/impl_gosec_test.go::TestDescribeModelRejectsTraversal asserts that describeModel("../../../etc/passwd") and three sibling traversal attempts each return an error (allowlist gate or not-found-in-model-tree), never a successful Stat. The test passes the post-fix tree and would fail against the pre-fix os.Stat(filepath.Join(root, nameOrPath)) direct path.