fix(security): suppress gosec false positives G703 and G118 (#136)

fail2ban/fail2ban_log_performance_benchmark_test.go

@@ -58,6 +58,7 @@ func setupBenchmarkLogEnvironment(b *testing.B, source string) func() {
 
 	tempDir := b.TempDir()
 	dest := filepath.Join(tempDir, "fail2ban.log")
+	// #nosec G703 -- dest is constructed from b.TempDir() and a literal string, not user input
 	if err := os.WriteFile(dest, data, 0o600); err != nil {
 		b.Fatalf("failed to create benchmark log file: %v", err)
 	}

fail2ban/fail2ban_logs_integration_test.go

@@ -418,6 +418,7 @@ func BenchmarkLogParsing(b *testing.B) {
 	if err != nil {
 		b.Fatalf("Failed to read test file: %v", err)
 	}
+	// #nosec G703 -- mainLog is constructed from b.TempDir() and a literal string, not user input
 	if err := os.WriteFile(mainLog, data, 0600); err != nil {
 		b.Fatalf("Failed to create test log: %v", err)
 	}

fail2ban/security_utils.go

@@ -57,14 +57,6 @@ func ContainsPathTraversal(input string) bool {
 // The returned patterns include both production patterns (real attack signatures)
 // and test sentinels (used exclusively in test fixtures for validation).
 func GetDangerousCommandPatterns() []string {
-	// Production patterns: Real command injection and SQL injection signatures
-	productionPatterns := []string{
-		"rm -rf",                     // Destructive file operations
-		"drop table",                 // SQL injection attempts
-		"'; cat",                     // Command injection with file reads
-		"/etc/passwd", "/etc/shadow", // Specific sensitive file access
-	}
-
 	// Test sentinels: Markers used exclusively in test fixtures
 	// These help verify pattern detection logic in tests
 	testSentinels := []string{
@@ -84,6 +76,16 @@ func GetDangerousCommandPatterns() []string {
 		"DANGEROUS_EVAL_FUNCTION",
 	}
 
-	// Combine both lists for backward compatibility
-	return append(productionPatterns, testSentinels...)
+	// Production patterns: Real command injection and SQL injection signatures
+	productionPatterns := []string{
+		"rm -rf",                     // Destructive file operations
+		"drop table",                 // SQL injection attempts
+		"'; cat",                     // Command injection with file reads
+		"/etc/passwd", "/etc/shadow", // Specific sensitive file access
+	}
+
+	// Combine both lists for backward compatibility; preallocate to avoid reallocation
+	combined := make([]string, 0, len(productionPatterns)+len(testSentinels))
+	combined = append(combined, productionPatterns...)
+	return append(combined, testSentinels...)
 }

fail2ban/test_helpers.go

@@ -45,6 +45,7 @@ func setupTestLogEnvironment(t *testing.T, testDataFile string) (cleanup func())
 	if err != nil {
 		t.Fatalf("Failed to read test file: %v", err)
 	}
+	// #nosec G703 -- path is constructed from t.TempDir() and a literal string, not user input
 	if err := os.WriteFile(mainLog, data, shared.DefaultFilePermissions); err != nil {
 		t.Fatalf("Failed to create test log: %v", err)
 	}