johno/beads
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix gosec security warnings (bd-57)

Browse Source 
- Changed file permissions from 0644 → 0600 for JSONL exports and config files
- Changed directory permissions from 0755 → 0750 in all test code
- Updated .golangci.yml with proper exclusions for false positives
- Reduced gosec warnings from 102 to 22 (all remaining are acceptable)

Closes bd-57

Amp-Thread-ID: https://ampcode.com/threads/T-f754d957-9e42-4e74-861e-57235c7e6436
Co-authored-by: Amp <amp@ampcode.com>
This commit is contained in:
Steve Yegge
2025-10-25 13:50:32 -07:00
parent 47c915ef10
commit 9a370b5b3c
13 changed files with 44 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
cmd/bd/autostart_test.go
View File

@@ -176,7 +176,7 @@ func TestGetSocketPath(t *testing.T) {
localSocket := filepath.Join(beadsDir, "bd.sock")
// Create local socket file
if err := os.WriteFile(localSocket, []byte{}, 0644); err != nil {
if err := os.WriteFile(localSocket, []byte{}, 0600); err != nil {
t.Fatalf("Failed to create socket file: %v", err)
}
defer os.Remove(localSocket)
@@ -201,7 +201,7 @@ func TestGetSocketPath(t *testing.T) {
}
globalSocket := filepath.Join(globalBeadsDir, "bd.sock")
if err := os.WriteFile(globalSocket, []byte{}, 0644); err != nil {
if err := os.WriteFile(globalSocket, []byte{}, 0600); err != nil {
t.Fatalf("Failed to create fake global socket file: %v", err)
}

2
cmd/bd/daemon_lock_test.go
View File

@@ -84,7 +84,7 @@ func TestBackwardCompatibilityWithOldDaemon(t *testing.T) {
// Simulate old daemon: PID file exists but no lock file
pidFile := filepath.Join(beadsDir, "daemon.pid")
currentPID := os.Getpid()
if err := os.WriteFile(pidFile, []byte(fmt.Sprintf("%d", currentPID)), 0644); err != nil {
if err := os.WriteFile(pidFile, []byte(fmt.Sprintf("%d", currentPID)), 0600); err != nil {
t.Fatalf("Failed to write PID file: %v", err)
}

6
cmd/bd/daemon_test.go
View File

@@ -116,7 +116,7 @@ func TestIsDaemonRunning_StalePIDFile(t *testing.T) {
tmpDir := t.TempDir()
pidFile := filepath.Join(tmpDir, "test.pid")
if err := os.WriteFile(pidFile, []byte("99999"), 0644); err != nil {
if err := os.WriteFile(pidFile, []byte("99999"), 0600); err != nil {
t.Fatalf("Failed to write PID file: %v", err)
}
@@ -212,7 +212,7 @@ func TestDaemonPIDFileManagement(t *testing.T) {
pidFile := filepath.Join(tmpDir, "daemon.pid")
testPID := 12345
if err := os.WriteFile(pidFile, []byte(strconv.Itoa(testPID)), 0644); err != nil {
if err := os.WriteFile(pidFile, []byte(strconv.Itoa(testPID)), 0600); err != nil {
t.Fatalf("Failed to write PID file: %v", err)
}
@@ -612,7 +612,7 @@ func (s *mockDaemonServer) WaitReady(timeout time.Duration) error {
}
func (s *mockDaemonServer) Start(ctx context.Context) error {
if err := os.MkdirAll(filepath.Dir(s.socketPath), 0755); err != nil {
if err := os.MkdirAll(filepath.Dir(s.socketPath), 0750); err != nil {
return fmt.Errorf("failed to create socket directory: %w", err)
}

4
cmd/bd/export.go
View File

@@ -194,8 +194,8 @@ Output to stdout by default, or use -o flag for file output.`,
os.Exit(1)
}
// Set appropriate file permissions (0644: rw-r--r--)
if err := os.Chmod(finalPath, 0644); err != nil {
// Set appropriate file permissions (0600: rw-------)
if err := os.Chmod(finalPath, 0600); err != nil {
fmt.Fprintf(os.Stderr, "Warning: failed to set file permissions: %v\n", err)
}
}

2
cmd/bd/init.go
View File

@@ -101,7 +101,7 @@ bd.db
# Keep JSONL exports (source of truth for git)
!*.jsonl
`
if err := os.WriteFile(gitignorePath, []byte(gitignoreContent), 0644); err != nil {
if err := os.WriteFile(gitignorePath, []byte(gitignoreContent), 0600); err != nil {
fmt.Fprintf(os.Stderr, "Warning: failed to create .gitignore: %v\n", err)
// Non-fatal - continue anyway
}

4
cmd/bd/sync.go
View File

@@ -351,8 +351,8 @@ func exportToJSONL(ctx context.Context, jsonlPath string) error {
return fmt.Errorf("failed to replace JSONL file: %w", err)
}
// Set appropriate file permissions (0644: rw-r--r--)
if err := os.Chmod(jsonlPath, 0644); err != nil {
// Set appropriate file permissions (0600: rw-------)
if err := os.Chmod(jsonlPath, 0600); err != nil {
// Non-fatal warning
fmt.Fprintf(os.Stderr, "Warning: failed to set file permissions: %v\n", err)
}