Skip to content

🛡️ Sentinel: [ENHANCEMENT] Fix gosec G204 false positive #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
euxaristia wants to merge 1 commit into
base: main
Choose a base branch
from
Open

🛡️ Sentinel: [ENHANCEMENT] Fix gosec G204 false positive #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
## 2026-08-04 - False Positive Subprocess Launch Findings
**Vulnerability:** Found uses of `exec.Command` and `exec.CommandContext` with variable inputs (gosec G204) that were false positives or necessary design choices, rather than security risks, such as invoking `git` locally with args array.
**Learning:** We need to be careful when assessing G204 in gosec as it flags any subprocess launched with a variable without verifying the provenance. When the invocation originates from trusted local configuration or literal constants, we should suppress the warning via `/* #nosec G204 -- [reason] */` instead of removing the capability which limits valid shell pipes or expanding variables.
**Prevention:** Apply `/* #nosec G204 -- reason */` selectively to known safe subprocess invocations where arguments are controlled or trusted.
2 changes: 2 additions & 0 deletions internal/config/command.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,8 +197,10 @@ func shellCommand(command string) *exec.Cmd {
if strings.HasPrefix(strings.TrimSpace(command), `"`) {
command = "call " + command
}
/* #nosec G204 -- command originates from trusted local configuration; shell invocation is intended for pipe/env support */
return exec.Command("cmd", "/C", command)
}
/* #nosec G204 -- command originates from trusted local configuration; shell invocation is intended for pipe/env support */
return exec.Command("sh", "-c", command)
}

Expand Down
Loading