Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Disable govulncheck due to false positive #83

Merged
merged 1 commit into from Oct 14, 2022
Merged

Disable govulncheck due to false positive #83

merged 1 commit into from Oct 14, 2022

Commits on Oct 13, 2022

  1. Disable govulncheck due to false positive 

    govulcheck detected a case where `--jq` user input directly constructs a regexp in gojq code, which govulncheck considers a failure since it can lead to denial-of-service attacks. This risk doesn't not affect us, however, since we're building CLI apps and not hosted apps. As a user, you can crash your own `gh` process using your own malicious input as much as you'd like.

govulncheck presently does not have a way of silencing or allow-listing specific violations, so this disables govulncheck completely.
    @mislav
    mislav committed Oct 13, 2022
    Copy the full SHA
    e0e54f8 View commit details
    Browse the repository at this point in the history