[FIX] Security issues

vauxoo-dev · Oct 18, 2024 · c9b3aa8 · c9b3aa8
1 parent b3ca668
commit c9b3aa8
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 3 deletions.
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
@@ -15,5 +15,5 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v6
         with:
-          version: v1.60
+          version: v1.61
           skip-cache: true
diff --git a/.github/workflows/gosec.yml b/.github/workflows/gosec.yml
@@ -13,8 +13,8 @@ jobs:
       GO111MODULE: on
     steps:
       - name: Checkout Source
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Run Gosec Security Scanner
         uses: securego/gosec@master
         with:
-          args: -exclude=G306 ./...
+          args: -exclude=G306 -exclude=G115 ./...
diff --git a/utils/bash.go b/utils/bash.go
@@ -1,6 +1,7 @@
 package utils
 
 import (
+	"math"
 	"os"
 	"os/exec"
 	"os/user"
@@ -24,11 +25,18 @@ func GetUserUIDs(username string) (uint32, uint32, error) {
 	if err != nil {
 		return 0, 0, err
 	}
+	if uid < 0 || uid > math.MaxUint32 {
+		uid = 0
+	}
 
 	gid, err := strconv.Atoi(u.Gid)
 	if err != nil {
 		return 0, 0, err
 	}
+	if gid < 0 || uid > math.MaxUint32 {
+		gid = 0
+	}
+
 	return uint32(uid), uint32(gid), nil
 }