From d512287e87c011eceb44bbbcbcb338bc4eef00f1 Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Wed, 26 Aug 2026 08:54:54 +0000
Subject: [PATCH] fix(lint): audit gosec G703/G704 taint sinks

Annotate five taint-analysis findings where the tainted input is
self-owned infrastructure: workspace busy-file paths resolved by the
agent, marker files under the fixed ContainerDataDir, GPG socket links
derived from $HOME and the current uid, the agent-written image config
path, and localhost credential posts on the agent-injected workspace
port.
---
 pkg/agent/agent.go              | 2 +-
 pkg/agent/dockerless.go         | 2 +-
 pkg/devcontainer/setup/setup.go | 2 +-
 pkg/dockercredentials/helper.go | 1 +
 pkg/gpg/gpg_forwarding.go       | 2 +-
 5 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkg/agent/agent.go b/pkg/agent/agent.go
index 3bc20f1d5..9ef05d524 100644
--- a/pkg/agent/agent.go
+++ b/pkg/agent/agent.go
@@ -311,7 +311,7 @@ func CreateWorkspaceBusyFile(folder string) {
 
 func HasWorkspaceBusyFile(folder string) bool {
 	filePath := filepath.Join(folder, config.WorkspaceBusyFile)
-	_, err := os.Stat(filePath)
+	_, err := os.Stat(filePath) // #nosec G703 -- folder is the agent-resolved workspace dir, not user input
 	return err == nil
 }
 
diff --git a/pkg/agent/dockerless.go b/pkg/agent/dockerless.go
index cab0cd217..113a78082 100644
--- a/pkg/agent/dockerless.go
+++ b/pkg/agent/dockerless.go
@@ -48,7 +48,7 @@ func GetDockerlessBuildContext() string {
 }
 
 func ImageConfigExists(path string) bool {
-	_, err := os.Stat(path)
+	_, err := os.Stat(path) // #nosec G703 -- path is the agent-written image config output, not user input
 	return err == nil
 }
 
diff --git a/pkg/devcontainer/setup/setup.go b/pkg/devcontainer/setup/setup.go
index 3878e7044..20fcee32c 100644
--- a/pkg/devcontainer/setup/setup.go
+++ b/pkg/devcontainer/setup/setup.go
@@ -604,7 +604,7 @@ func markerFileExists(markerName string, markerContent string) (bool, error) {
 		filepath.Dir(markerName),
 		0o755,
 	) // #nosec G301 -- Standard directory permissions
-	err = os.WriteFile(markerName, []byte(markerContent), 0o600)
+	err = os.WriteFile(markerName, []byte(markerContent), 0o600) // #nosec G703 -- fixed caller-defined marker name under ContainerDataDir
 	if err != nil {
 		return false, fmt.Errorf("write marker: %w", err)
 	}
diff --git a/pkg/dockercredentials/helper.go b/pkg/dockercredentials/helper.go
index b2b62f861..e8c861de0 100644
--- a/pkg/dockercredentials/helper.go
+++ b/pkg/dockercredentials/helper.go
@@ -137,6 +137,7 @@ func (h *Helper) getFromWorkspaceServer(serverURL string) (string, string, error
 
 	client := &http.Client{Timeout: credentialsTimeout}
 	endpoint := fmt.Sprintf("http://localhost:%s/docker-credentials", workspacePort)
+	// #nosec G704 -- endpoint is localhost with the workspace credentials port injected by the agent
 	resp, err := client.Post(endpoint, "application/json", bytes.NewReader(requestBody))
 	if err != nil {
 		return "", "", err
diff --git a/pkg/gpg/gpg_forwarding.go b/pkg/gpg/gpg_forwarding.go
index 9a4e18124..aa10b025b 100644
--- a/pkg/gpg/gpg_forwarding.go
+++ b/pkg/gpg/gpg_forwarding.go
@@ -169,7 +169,7 @@ func (g *GPGConf) SetupRemoteSocketLink(ctx context.Context) error {
 		if err := os.MkdirAll(filepath.Dir(link), 0o700); err != nil {
 			return err
 		}
-		_ = os.Remove(link)
+		_ = os.Remove(link) // #nosec G703 -- link derives from $HOME and the current uid, not user input
 		if err := os.Symlink(g.SocketPath, link); err != nil {
 			return err
 		}