From 1d955a8762598c020dcb7e114ce0e870cf78aebb Mon Sep 17 00:00:00 2001
From: Oleg Gaidarenko <markelog@gmail.com>
Date: Thu, 28 Mar 2019 14:17:07 +0100
Subject: [PATCH] Chore: Implement gosec (#16261)

See https://github.com/securego/gosec for more info.

Disabled a lot of rules. I guess we should go through them
and recheck if we really need to disable some

Fixes #16204
---
 pkg/components/imguploader/gcsuploader.go | 2 +-
 scripts/backend-lint.sh                   | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkg/components/imguploader/gcsuploader.go b/pkg/components/imguploader/gcsuploader.go
index cb1ae19059d..4513019ad98 100644
--- a/pkg/components/imguploader/gcsuploader.go
+++ b/pkg/components/imguploader/gcsuploader.go
@@ -14,7 +14,7 @@ import (
 )
 
 const (
-	tokenUrl  string = "https://www.googleapis.com/auth/devstorage.read_write"
+	tokenUrl  string = "https://www.googleapis.com/auth/devstorage.read_write" // #nosec
 	uploadUrl string = "https://www.googleapis.com/upload/storage/v1/b/%s/o?uploadType=media&name=%s&predefinedAcl=publicRead"
 )
 
diff --git a/scripts/backend-lint.sh b/scripts/backend-lint.sh
index 98519d59a00..dcddaaddc70 100755
--- a/scripts/backend-lint.sh
+++ b/scripts/backend-lint.sh
@@ -20,6 +20,7 @@ go get -u github.com/mdempsky/unconvert
 go get -u github.com/opennota/check/cmd/varcheck
 go get -u honnef.co/go/tools/cmd/staticcheck
 go get -u github.com/mgechev/revive
+go get -u github.com/securego/gosec/cmd/gosec/...
 
 exit_if_fail gometalinter --enable-gc --vendor --deadline 10m --disable-all \
   --enable=deadcode \
@@ -33,3 +34,6 @@ exit_if_fail gometalinter --enable-gc --vendor --deadline 10m --disable-all \
 
 exit_if_fail go vet ./pkg/...
 exit_if_fail revive -formatter stylish -config ./conf/revive.toml
+
+# TODO recheck the rules and leave only necessary exclusions
+exit_if_fail gosec -quiet -exclude=G104,G107,G201,G202,G204,G301,G302,G304,G402,G501,G505,G401 ./pkg/...