Merge branch 'master' into dependabot/github_actions/actions/setup-go-4

.github/workflows/go.yml

@@ -1,22 +1,23 @@
 # This file adheres to the YAML5 style.
 {
   name: "Go",
-  on: ["push", "pull_request"],
+  on: [ "push", "pull_request" ],
   jobs: {
     build: {
       name: "Build",
       "runs-on": "ubuntu-latest",
+      strategy: { matrix: { "go-version": [ "stable", "oldstable"] } },
       steps: [
+        { name: "Check out code into the Go module directory", uses: "actions/checkout@v4" },
         {
-          name: "Set up Go 1.18",
+          name: "Set up Go ${{ matrix.go-version }}",
           uses: "actions/setup-go@v4",
-          "with": {"go-version": 1.18},
+          with: { "go-version": "${{ matrix.go-version }}" },
           id: "go",
         },
-        {name: "Check out code into the Go module directory", uses: "actions/checkout@v1"},
-        {name: "Linter", run: "make lint"},
-        {name: "Test", run: "make test"},
-        {name: "Test release", run: "make test-release"},
+        { name: "Linter", run: "make lint" },
+        { name: "Test", run: "make test" },
+        { name: "Test release", run: "make test-release" },
       ],
     },
   },

.github/workflows/merge.yml

@@ -11,7 +11,7 @@
       name: "Build",
       "runs-on": "ubuntu-latest",
       steps: [
-        {name: "Check out code into the Go module directory", uses: "actions/checkout@v1"},
+        {name: "Check out code into the Go module directory", uses: "actions/checkout@v4"},
         {name: "Test master", run: "make test-master"},
         {name: "Test release", run: "make test-release"},
       ],

.github/workflows/release-management.yml

@@ -11,6 +11,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Drafts your next Release notes as Pull Requests are merged into "master"
-      - uses: toolmantim/release-drafter@v5.12.1
+      - uses: toolmantim/release-drafter@v6.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.golangci.yml

@@ -6,36 +6,39 @@
   "fast": false,
   "linters": {
     "enable": [
-      "deadcode",
       "errcheck",
-      "gas",
+      "gosec",
       "gocritic",
       "gofmt",
       "goimports",
-      "golint",
       "govet",
       "gosimple",
       "ineffassign",
-      "megacheck",
       "misspell",
       "nakedret",
       "staticcheck",
-      "structcheck",
       "typecheck",
       "unconvert",
       "unparam",
       "unused",
-      "varcheck",
     ],
   },
   "disable": [
+    "deadcode", # deprecated
     "depguard",
     "dupl",
+    "exhaustivestruct", # deprecated
     "gocyclo",
-    "interfacer",
+    "golint", # deprecated
+    "ifshort", # deprecated
+    "interfacer", # deprecated
     "lll",
-    "maligned",
+    "maligned", # deprecated
+    "nosnakecase", # deprecated
     "prealloc",
+    "scopelint", # deprecated
+    "structcheck", # deprecated
+    "varcheck", # deprecated
   ],
   "linters-settings": {
     "gocritic": {

Makefile

@@ -32,7 +32,7 @@ test-release:
 	@echo "everything is OK"
 
 lint:
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOPATH_DIR)/bin v1.49.0
+	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOPATH_DIR)/bin v1.54.0
 	$(GOPATH_DIR)/bin/golangci-lint run ./...
 	go build -o go-ruleguard ./cmd/ruleguard
 	./go-ruleguard -debug-imports -rules rules.go ./...

_docs/dsl.md

@@ -65,7 +65,7 @@ To add such documentation, use special pragmas when commenting a matcher functio
 //doc:summary reports always false/true conditions
 //doc:before  strings.Count(s, "/") >= 0
 //doc:after   strings.Count(s, "/") > 0
-//doc:tags    diagnostic exprimental
+//doc:tags    diagnostic experimental
 func badCond(m dsl.Matcher) {
 	m.Match(`strings.Count($_, $_) >= 0`).Report(`statement always true`)
 	m.Match(`bytes.Count($_, $_) >= 0`).Report(`statement always true`)

_docs/rules.go

@@ -230,7 +230,7 @@ func gocriticBadCall(m dsl.Matcher) {
 		`bytes.Replace($_, $_, $_, 0)`,
 		`strings.SplitN($_, $_, 0)`,
 		`bytes.SplitN($_, $_, 0)`).
-		Report(`n=0 argument does nothing, maybe n=-1 is indended?`)
+		Report(`n=0 argument does nothing, maybe n=-1 is intended?`)
 
 	m.Match(`append($_)`).
 		Report(`append called with 1 argument does nothing`)

analyzer/analyzer.go

@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"fmt"
 	"go/token"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -232,7 +231,7 @@ func newEngine() (*ruleguard.Engine, error) {
 		filenames := strings.Split(flagRules, ",")
 		for _, filename := range filenames {
 			filename = strings.TrimSpace(filename)
-			data, err := ioutil.ReadFile(filename)
+			data, err := os.ReadFile(filename)
 			if err != nil {
 				return nil, fmt.Errorf("read rules file: %v", err)
 			}

analyzer/analyzer_test.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"go/token"
 	"io/fs"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -180,7 +179,7 @@ var rulesFile = %s
 		}
 		t.Run(test.name, func(t *testing.T) {
 			rulesFilename := filepath.Join(wd, "testdata", "src", test.name, "rules.go")
-			data, err := ioutil.ReadFile(rulesFilename)
+			data, err := os.ReadFile(rulesFilename)
 			if err != nil {
 				t.Fatalf("%s: %v", test.name, err)
 			}
@@ -205,7 +204,7 @@ var rulesFile = %s
 			}
 			var irfileBuf bytes.Buffer
 			irprint.File(&irfileBuf, irfile)
-			mainFile, err := ioutil.TempFile("", "ruleguard-test*.go")
+			mainFile, err := os.CreateTemp("", "ruleguard-test*.go")
 			if err != nil {
 				t.Fatal(err)
 			}

analyzer/testdata/src/gocritic/f1.go

@@ -60,7 +60,7 @@ func appendCombine2(xs []int, aa []int, bb []int) []int {
 }
 
 func badCall(s string, xs []int) {
-	_ = strings.Replace(s, "a", "b", 0) // want `\Qn=0 argument does nothing, maybe n=-1 is indended?`
+	_ = strings.Replace(s, "a", "b", 0) // want `\Qn=0 argument does nothing, maybe n=-1 is intended?`
 	_ = append(xs)                      // want `\Qappend called with 1 argument does nothing`
 }
 

analyzer/testdata/src/gocritic/rules.go

@@ -54,7 +54,7 @@ func testRules(m dsl.Matcher) {
 		Report(`$dst=append($x,$a,$b) is faster`)
 
 	m.Match(`strings.Replace($_, $_, $_, 0)`).
-		Report(`n=0 argument does nothing, maybe n=-1 is indended?`)
+		Report(`n=0 argument does nothing, maybe n=-1 is intended?`)
 
 	m.Match(`append($_)`).
 		Report(`append called with 1 argument does nothing`)

cmd/gorules/main.go

@@ -2,8 +2,6 @@ package main
 
 import (
 	"bytes"
-	"os"
-
 	"encoding/json"
 	"flag"
 	"fmt"
@@ -12,8 +10,8 @@ import (
 	"go/parser"
 	"go/token"
 	"go/types"
-	"io/ioutil"
 	"log"
+	"os"
 	"path/filepath"
 	"strings"
 
@@ -86,7 +84,7 @@ func docCommand(args []string) error {
 	filenames := strings.Split(*flagRules, ",")
 	for _, filename := range filenames {
 		filename = strings.TrimSpace(filename)
-		data, err := ioutil.ReadFile(filename)
+		data, err := os.ReadFile(filename)
 		if err != nil {
 			return fmt.Errorf("read rules file: %v", err)
 		}
@@ -164,7 +162,7 @@ func precompileCommand(args []string) error {
 
 	fset := token.NewFileSet()
 	filename := strings.TrimSpace(*flagRules)
-	fileData, err := ioutil.ReadFile(filename)
+	fileData, err := os.ReadFile(filename)
 	if err != nil {
 		return fmt.Errorf("read %s: %v", filename, err)
 	}

dsl/dsl.go

@@ -106,7 +106,7 @@ type Var struct {
 	Const bool
 
 	// ConstSlice reports whether expr matched by var is a slice literal
-	// consisting of contant elements.
+	// consisting of constant elements.
 	//
 	// We need a separate Const-like predicate here because Go doesn't
 	// treat slices of const elements as constants, so including

go.mod

@@ -1,20 +1,19 @@
 module github.com/quasilyte/go-ruleguard
 
-go 1.17
+go 1.19
 
 require (
 	github.com/go-toolsmith/astcopy v1.0.2
-	github.com/google/go-cmp v0.5.9
+	github.com/google/go-cmp v0.6.0
 	github.com/quasilyte/go-ruleguard/dsl v0.3.22
 	github.com/quasilyte/go-ruleguard/rules v0.0.0-20211022131956-028d6511ab71
 	github.com/quasilyte/gogrep v0.5.0
 	github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567
-	golang.org/x/exp/typeparams v0.0.0-20230307190834-24139beb5833
-	golang.org/x/tools v0.7.0
+	golang.org/x/exp/typeparams v0.0.0-20240213143201-ec583247a57a
+	golang.org/x/tools v0.18.0
 )
 
 require (
 	github.com/go-toolsmith/astequal v1.0.3 // indirect
-	golang.org/x/mod v0.9.0 // indirect
-	golang.org/x/sys v0.6.0 // indirect
+	golang.org/x/mod v0.15.0 // indirect
 )

go.sum

@@ -7,8 +7,8 @@ github.com/go-toolsmith/strparse v1.0.0 h1:Vcw78DnpCAKlM20kSbAyO4mPfJn/lyYA4BJUD
 github.com/go-toolsmith/strparse v1.0.0/go.mod h1:YI2nUKP9YGZnL/L1/DLFBfixrcjslWct4wyljWhSRy8=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/quasilyte/go-ruleguard v0.3.1-0.20210203134552-1b5a410e1cc8/go.mod h1:KsAh3x0e7Fkpgs+Q9pNLS5XpFSvYCEVl5gP9Pp1xp30=
 github.com/quasilyte/go-ruleguard/dsl v0.3.0/go.mod h1:KeCP03KrjuSO0H1kTuZQCWlQPulDV6YMIXmpQss17rU=
 github.com/quasilyte/go-ruleguard/dsl v0.3.22 h1:wd8zkOhSNr+I+8Qeciml08ivDt1pSXe60+5DqOpCjPE=
@@ -22,63 +22,35 @@ github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 h1:M8mH9eK4OUR4l
 github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567/go.mod h1:DWNGW8A4Y+GyBgPuaQJuWiy0XYftx4Xm/y5Jqk9I6VQ=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/exp/typeparams v0.0.0-20220428152302-39d4317da171/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
-golang.org/x/exp/typeparams v0.0.0-20221002003631-540bb7301a08 h1:VpoGhesgULkabDHoDFGayS1wnkasmT95Jq2xZDwN45Q=
-golang.org/x/exp/typeparams v0.0.0-20221002003631-540bb7301a08/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
-golang.org/x/exp/typeparams v0.0.0-20230307190834-24139beb5833 h1:jWGQJV4niP+CCmFW9ekjA9Zx8vYORzOUH2/Nl5WPuLQ=
-golang.org/x/exp/typeparams v0.0.0-20230307190834-24139beb5833/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
+golang.org/x/exp/typeparams v0.0.0-20240213143201-ec583247a57a h1:rrd/FiSCWtI24jk057yBSfEfHrzzjXva1VkDNWRXMag=
+golang.org/x/exp/typeparams v0.0.0-20240213143201-ec583247a57a/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.9.0 h1:KENHtAZL2y3NLMYZeHY9DW8HW8V+kQyJsY/V9JlKvCs=
-golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.15.0 h1:SernR4v+D55NyBH2QiEQrlBAnj1ECL6AGrA5+dPaMY8=
+golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200812195022-5ae4c3c160a0/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20201230224404-63754364767c/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.7.0 h1:W4OVu8VVOaIO0yzWMNdepAulS7YfoS3Zabrm8DOXXU4=
-golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
+golang.org/x/tools v0.18.0 h1:k8NLag8AGHnn+PHbl7g43CtqZAwG60vZkLqgyZgIHgQ=
+golang.org/x/tools v0.18.0/go.mod h1:GL7B4CwcLLeo59yx/9UWWuNOW1n3VZ4f5axWfML7Lcg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

internal/goenv/goenv.go

@@ -3,46 +3,26 @@ package goenv
 import (
 	"errors"
 	"os/exec"
-	"runtime"
-	"strconv"
 	"strings"
 )
 
 func Read() (map[string]string, error) {
-	out, err := exec.Command("go", "env").CombinedOutput()
+	// pass in a fixed set of var names to avoid needing to unescape output
+	// pass in literals here instead of a variable list to avoid security linter warnings about command injection
+	out, err := exec.Command("go", "env", "GOROOT", "GOPATH", "GOARCH", "GOOS", "CGO_ENABLED").CombinedOutput()
 	if err != nil {
 		return nil, err
 	}
-	return parseGoEnv(out, runtime.GOOS)
+	return parseGoEnv([]string{"GOROOT", "GOPATH", "GOARCH", "GOOS", "CGO_ENABLED"}, out)
 }
 
-func parseGoEnv(data []byte, goos string) (map[string]string, error) {
+func parseGoEnv(varNames []string, data []byte) (map[string]string, error) {
 	vars := make(map[string]string)
 
 	lines := strings.Split(strings.ReplaceAll(string(data), "\r\n", "\n"), "\n")
-
-	if goos == "windows" {
-		// Line format is: `set $name=$value`
-		for _, l := range lines {
-			l = strings.TrimPrefix(l, "set ")
-			parts := strings.Split(l, "=")
-			if len(parts) != 2 {
-				continue
-			}
-			vars[parts[0]] = parts[1]
-		}
-	} else {
-		// Line format is: `$name="$value"`
-		for _, l := range lines {
-			parts := strings.Split(strings.TrimSpace(l), "=")
-			if len(parts) != 2 {
-				continue
-			}
-			val, err := strconv.Unquote(parts[1])
-			if err != nil {
-				continue
-			}
-			vars[parts[0]] = val
+	for i, varName := range varNames {
+		if i < len(lines) && len(lines[i]) > 0 {
+			vars[varName] = lines[i]
 		}
 	}