Bound waiver audit history reads

internal/codeguard/runner/support/waiver_audit_history.go

@@ -1,12 +1,11 @@
 package support
 
 import (
-	"encoding/json"
 	"fmt"
-	"os"
 	"strings"
 	"time"
 
+	"github.com/devr-tools/codeguard/internal/codeguard/cachefile"
 	"github.com/devr-tools/codeguard/internal/codeguard/core"
 	"github.com/devr-tools/codeguard/internal/version"
 )
@@ -28,12 +27,8 @@ func LoadWaiverAuditHistory(path string) []core.WaiverAuditHistoryEntry {
 	if strings.TrimSpace(path) == "" {
 		return nil
 	}
-	data, err := os.ReadFile(path) //nolint:gosec // config-supplied waiver-audit history cache path
-	if err != nil {
-		return nil
-	}
 	var file waiverAuditHistoryFile
-	if err := json.Unmarshal(data, &file); err != nil || file.Version != waiverAuditHistoryVersion {
+	if !cachefile.Load(path, &file) || file.Version != waiverAuditHistoryVersion {
 		return nil
 	}
 	return file.Entries

tests/support/waiver_audit_history_test.go

@@ -0,0 +1,28 @@
+package support_test
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	runnersupport "github.com/devr-tools/codeguard/internal/codeguard/runner/support"
+)
+
+func TestLoadWaiverAuditHistoryRejectsOversizedFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "cache.waiver-audit-history.json")
+	f, err := os.Create(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := f.Truncate((32 << 20) + 1); err != nil {
+		_ = f.Close()
+		t.Fatal(err)
+	}
+	if err := f.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	if got := runnersupport.LoadWaiverAuditHistory(path); len(got) != 0 {
+		t.Fatalf("expected empty history for oversized file, got %#v", got)
+	}
+}