From 9e95ef0dbd3beb942ff8cc88495fee04bb23b82b Mon Sep 17 00:00:00 2001 From: Ettore Di Giacinto Date: Sun, 27 Sep 2026 08:42:12 +0000 Subject: [PATCH] fix: resolve gosec alerts in files this change touches Code scanning reports alerts on every line of a touched file. Mark the gRPC auth env var name and the mock backend's staged-path reads as reviewed, and log the error when evicting a model after its connection fails instead of dropping it. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Ettore Di Giacinto --- pkg/grpc/server.go | 2 +- pkg/model/initializers.go | 12 +++++++++--- tests/e2e/mock-backend/main.go | 3 ++- 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/pkg/grpc/server.go b/pkg/grpc/server.go index fa0560ed7..ec3021ebb 100644 --- a/pkg/grpc/server.go +++ b/pkg/grpc/server.go @@ -1098,7 +1098,7 @@ func NewBackendServer(model AIModel) pb.BackendServer { } // AuthTokenEnvVar is the environment variable used to configure gRPC bearer token auth. -const AuthTokenEnvVar = "LOCALAI_GRPC_AUTH_TOKEN" +const AuthTokenEnvVar = "LOCALAI_GRPC_AUTH_TOKEN" // #nosec G101 -- the name of an environment variable, not a credential // validateToken extracts the bearer token from gRPC metadata and validates it. func validateToken(ctx context.Context, expected string) error { diff --git a/pkg/model/initializers.go b/pkg/model/initializers.go index ce046e882..2ae9242e3 100644 --- a/pkg/model/initializers.go +++ b/pkg/model/initializers.go @@ -479,7 +479,9 @@ func (ml *ModelLoader) Load(opts ...Option) (grpc.Backend, error) { // Wrap remote models so connection errors during inference trigger eviction if m.Process() == nil { client = newConnectionEvictingClient(client, o.modelID, func() { - ml.ShutdownModel(o.modelID) + if err := ml.ShutdownModel(o.modelID); err != nil { + xlog.Debug("evicting a model after its connection failed", "model", o.modelID, "error", err) + } }) } return client, nil @@ -503,7 +505,9 @@ func (ml *ModelLoader) Load(opts ...Option) (grpc.Backend, error) { // Wrap remote models so connection errors during inference trigger eviction if m := ml.CheckIsLoaded(o.modelID); m != nil && m.Process() == nil { client = newConnectionEvictingClient(client, o.modelID, func() { - ml.ShutdownModel(o.modelID) + if err := ml.ShutdownModel(o.modelID); err != nil { + xlog.Debug("evicting a model after its connection failed", "model", o.modelID, "error", err) + } }) } return client, nil @@ -544,7 +548,9 @@ func (ml *ModelLoader) Load(opts ...Option) (grpc.Backend, error) { // Wrap remote models so connection errors during inference trigger eviction if m := ml.CheckIsLoaded(o.modelID); m != nil && m.Process() == nil { model = newConnectionEvictingClient(model, o.modelID, func() { - ml.ShutdownModel(o.modelID) + if err := ml.ShutdownModel(o.modelID); err != nil { + xlog.Debug("evicting a model after its connection failed", "model", o.modelID, "error", err) + } }) } return model, nil diff --git a/tests/e2e/mock-backend/main.go b/tests/e2e/mock-backend/main.go index 0d842b42e..f6b0ecf08 100644 --- a/tests/e2e/mock-backend/main.go +++ b/tests/e2e/mock-backend/main.go @@ -648,6 +648,7 @@ func (m *MockBackend) AudioTranscription(ctx context.Context, in *pb.TranscriptR rms := 0.0 if dst != "" { + // #nosec G304 -- test-only mock backend reading the path core just staged if data, err := os.ReadFile(dst); err == nil { if len(data) >= 44 { wavSR = int(binary.LittleEndian.Uint32(data[24:28])) @@ -1018,7 +1019,7 @@ func (m *MockBackend) ModelMetadata(ctx context.Context, in *pb.ModelOptions) (* // survive resampling (DC is sample-rate independent). Near-zero DC maps to a // neutral vector equidistant from both. Returns nil for unreadable audio. func voiceEmbedFromWAV(path string) []float32 { - data, err := os.ReadFile(path) + data, err := os.ReadFile(path) // #nosec G304 -- test-only mock backend reading the path core just staged if err != nil || len(data) < 44 { return nil }