From 1b6f40682aef7878443e2154b6f044895e32099a Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Wed, 26 Aug 2026 09:57:53 +0000
Subject: [PATCH] fix: silence gosec G204 on intentional exec calls

Annotate subprocess invocations that are intentionally dynamic with #nosec G204 justifications: su-based command execution, vcluster/vscode CLI wrappers, apk installs, and ssh session shells. Clears all gosec G204 findings.
---
 pkg/command/command.go          |  9 ++++++++-
 pkg/devsyconfig/config.go       |  8 +++++++-
 pkg/ide/vscode/apk.go           |  5 +++--
 pkg/ide/vscode/open.go          | 14 ++++++++++++--
 pkg/ide/vscode/vscode.go        | 13 ++++++++++---
 pkg/ssh/server/ssh_container.go |  8 ++++++--
 6 files changed, 46 insertions(+), 11 deletions(-)

diff --git a/pkg/command/command.go b/pkg/command/command.go
index 9d04fcf67..bffd740f3 100644
--- a/pkg/command/command.go
+++ b/pkg/command/command.go
@@ -51,6 +51,13 @@ func ExistsForUser(cmd, user string) bool {
 		return Exists(cmd)
 	}
 
-	_, err = exec.Command("su", user, "-l", "-c", command).CombinedOutput()
+	_, err = exec.Command( // #nosec G204 -- runs the caller-provided command as the target workspace user
+		"su",
+		user,
+		"-l",
+		"-c",
+		command,
+	).
+		CombinedOutput()
 	return err == nil
 }
diff --git a/pkg/devsyconfig/config.go b/pkg/devsyconfig/config.go
index a603f455a..78496525d 100644
--- a/pkg/devsyconfig/config.go
+++ b/pkg/devsyconfig/config.go
@@ -44,7 +44,13 @@ func AuthVClusterCliToPlatform(config *client.Config) error {
 		return nil
 	}
 
-	cmd := exec.Command("vcluster", "login", "--access-key", config.AccessKey, config.Host)
+	cmd := exec.Command( // #nosec G204 -- vcluster resolved via LookPath above; args come from local config
+		"vcluster",
+		"login",
+		"--access-key",
+		config.AccessKey,
+		config.Host,
+	)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		log.Debugf("Failed executing `vcluster login` : %v, output: %s", err, out)
diff --git a/pkg/ide/vscode/apk.go b/pkg/ide/vscode/apk.go
index 6a19dfa47..d188cc7ea 100644
--- a/pkg/ide/vscode/apk.go
+++ b/pkg/ide/vscode/apk.go
@@ -38,8 +38,9 @@ func InstallAPKRequirements() {
 		dependencies = append(dependencies, "curl")
 	}
 
-	out, err := exec.Command("sh", "-c", "apk update && apk add "+strings.Join(dependencies, " ")).
-		CombinedOutput()
+	out, err := exec.Command( // #nosec G204 -- package names come from a static list above
+		"sh", "-c", "apk update && apk add "+strings.Join(dependencies, " "),
+	).CombinedOutput()
 	if err != nil {
 		log.Errorf("Error updating apk dependencies: %v", command.WrapCommandError(out, err))
 	}
diff --git a/pkg/ide/vscode/open.go b/pkg/ide/vscode/open.go
index 9db1a87cb..8f5c9102c 100644
--- a/pkg/ide/vscode/open.go
+++ b/pkg/ide/vscode/open.go
@@ -172,7 +172,12 @@ func openViaCLI(ctx context.Context, params OpenParams) error {
 		cliPath,
 		strings.Join(args, " "),
 	)
-	out, err := exec.CommandContext(ctx, cliPath, args...).CombinedOutput()
+	out, err := exec.CommandContext( // #nosec G204 -- cliPath resolved by getCLIPath; args built internally
+		ctx,
+		cliPath,
+		args...,
+	).
+		CombinedOutput()
 	if err != nil {
 		return command.WrapCommandError(out, err)
 	}
@@ -209,7 +214,12 @@ func listInstalledExtensions(
 func ensureSSHExtension(ctx context.Context, cliPath, sshExtension string) error {
 	args := []string{"--install-extension", sshExtension}
 	log.Debugf("%s %s", cliPath, strings.Join(args, " "))
-	out, err := exec.CommandContext(ctx, cliPath, args...).CombinedOutput()
+	out, err := exec.CommandContext( // #nosec G204 -- cliPath resolved by getCLIPath; extension id from static config
+		ctx,
+		cliPath,
+		args...,
+	).
+		CombinedOutput()
 	if err != nil {
 		return command.WrapCommandError(out, err)
 	}
diff --git a/pkg/ide/vscode/vscode.go b/pkg/ide/vscode/vscode.go
index 4bb7c972b..e5d3f49b9 100644
--- a/pkg/ide/vscode/vscode.go
+++ b/pkg/ide/vscode/vscode.go
@@ -208,9 +208,16 @@ func (o *VsCodeServer) buildExtensionCommand(binPath, extension string) *exec.Cm
 
 	if o.userName != "" {
 		cmd := shellescape.QuoteCommand(append([]string{binPath}, args...))
-		return exec.Command("su", o.userName, "-c", cmd)
-	}
-	return exec.Command(binPath, args...)
+		return exec.Command(
+			"su",
+			o.userName,
+			"-c",
+			cmd,
+		) // #nosec G204 -- runs the workspace user's extension install by design
+	}
+	return exec.Command(
+		binPath,
+		args...) // #nosec G204 -- binPath resolved from known server locations
 }
 
 func (o *VsCodeServer) findServerBinaryPath(location string) string {
diff --git a/pkg/ssh/server/ssh_container.go b/pkg/ssh/server/ssh_container.go
index ac5cdaeda..6771b1b2b 100644
--- a/pkg/ssh/server/ssh_container.go
+++ b/pkg/ssh/server/ssh_container.go
@@ -143,10 +143,14 @@ func (s *containerServer) getCommand(sess ssh.Session, isPty bool) (*exec.Cmd, e
 	}
 
 	if len(sess.RawCommand()) == 0 {
-		cmd = exec.Command(shell[0], args...)
+		cmd = exec.Command(
+			shell[0],
+			args...) // #nosec G204 -- ssh sessions run the user's login shell by design
 	} else {
 		args = append(args, "-c", sess.RawCommand())
-		cmd = exec.Command(shell[0], args...)
+		cmd = exec.Command(
+			shell[0],
+			args...) // #nosec G204 -- running the session's raw command is this server's purpose
 	}
 
 	err = config.PrepareCmdUser(cmd, user)