From ef647d89cf82288fa03d946a305498a6ae7bc4bc Mon Sep 17 00:00:00 2001 From: Ettore Di Giacinto Date: Mon, 27 Jul 2026 14:33:48 +0000 Subject: [PATCH] fix(utils): annotate the two G304 sites this branch introduced gosec flags os.Open on a variable path, and both new call sites in ffmpeg.go are its alerts on this PR. Neither is reachable by an outside caller: isPCM16Wav opens the exact path it is about to hand ffmpeg as input, which in the upload path is a server-created temp file named from path.Base of the client name so no traversal survives, and wavAudioBytes opens AudioResample's own dst, a name this package derives from src and has just had ffmpeg write. Annotated in the repo's existing style rather than restructured, with the reason spelled out, because a bare suppression is worth nothing to the next reader. The three other G304 sites in this file, in passthroughWAV and isTargetWav, predate the branch and are left untouched. Signed-off-by: Ettore Di Giacinto Assisted-by: Claude:claude-opus-5 [Claude Code] --- pkg/utils/ffmpeg.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pkg/utils/ffmpeg.go b/pkg/utils/ffmpeg.go index aae4d0592..08ec9564b 100644 --- a/pkg/utils/ffmpeg.go +++ b/pkg/utils/ffmpeg.go @@ -117,6 +117,12 @@ func convertWithFFmpeg(src, dst string) error { // a failed request, and music files, which are the input this passthrough // exists for, are exactly where extensible turns up. func isPCM16Wav(src string) bool { + // #nosec G304 -- src is the very path the caller is about to hand ffmpeg as + // its input, so opening it here reaches nothing ffmpeg would not. In the + // upload path it is a server-created temp file whose name is + // filepath.Join(server-made dir, path.Base(client name)), so no traversal + // survives. This only reads to classify the format, and any error returns + // false, which takes the transcode branch rather than the passthrough. f, err := os.Open(src) if err != nil { return false @@ -185,6 +191,10 @@ func AudioResample(src string, sampleRate int) (string, error) { // size and the parsed duration say "audio", and only the file length says the // truth. A plain size check does not work either, since the file is not empty. func wavAudioBytes(path string) int64 { + // #nosec G304 -- the only caller passes AudioResample's own dst, a name + // this package derives from src by string substitution and has just had + // ffmpeg write. Nothing outside chooses it, and the file being inspected is + // one we created moments earlier. f, err := os.Open(path) if err != nil { return -1