Merge pull request #18 from aserto-dev/CVE-2025-22870

CVE 2025 22870

Author: ronenh

.github/workflows/ci.yaml

@@ -17,7 +17,7 @@ on:
 env:
   PRE_RELEASE: ${{ github.ref == 'refs/heads/main' && 'development' || '' }}
   GO_VERSION: "1.23"
-  GO_LANGCI_LINT_VERSION: "v1.61.0"
+  GO_LANGCI_LINT_VERSION: v2.0.2
   GO_TESTSUM_VERSION: "1.11.0"
 
 jobs:
@@ -33,7 +33,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
       -
         name: Lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v7
         with:
           version: ${{ env.GO_LANGCI_LINT_VERSION }}
           verify: false  # `golangci-lint config verify` checks against the latest schema instead of its own version.

.golangci.yaml

@@ -1,150 +1,52 @@
 ---
-# golangci.com configuration
-# https://github.com/golangci/golangci/wiki/Configuration
+# Configuration
+# https://golangci-lint.run/usage/configuration/
 
-linters-settings:
-  funlen:
-    lines: 100
-    statements: 80
-  goconst:
-    min-len: 2
-    min-occurrences: 2
-  gocritic:
-    enabled-tags:
-      - diagnostic
-      - experimental
-      - opinionated
-      - performance
-      - style
-    disabled-checks:
-      - dupImport  #  https://github.com/go-critic/go-critic/issues/845
-      - ifElseChain
-      - octalLiteral
-      - whyNoLint
-      - wrapperFunc
-  gocyclo:
-    min-complexity: 18
-  goimports:
-    local-prefixes: github.com/golangci/golangci-lint
-  mnd:
-    checks:
-      - argument
-      - case
-      - condition
-      - return
-  govet:
-    shadow: true
-    settings:
-      printf:
-        funcs:
-          - (github.com/golangci/golangci-lint/pkg/logutils.Log).Infof
-          - (github.com/golangci/golangci-lint/pkg/logutils.Log).Warnf
-          - (github.com/golangci/golangci-lint/pkg/logutils.Log).Errorf
-          - (github.com/golangci/golangci-lint/pkg/logutils.Log).Fatalf
-  lll:
-    line-length: 140
-  misspell:
-    locale: US
-  nolintlint:
-    allow-unused: false  # report any unused nolint directives
-    require-explanation: false  # don't require an explanation for nolint directives
-    require-specific: false  # don't require nolint directives to be specific about which linter is being skipped
+version: "2"
 
 linters:
-  # please, do not use `enable-all`: it's deprecated and will be removed soon.
-  # inverted configuration with `enable-all` and `disable` is not scalable during updates of golangci-lint
-  disable-all: false
+  # https://golangci-lint.run/usage/configuration/#linters-configuration
+  default: all
+
+  # explicitly disabled linters
+  disable:
+    - depguard
+    - exhaustruct
+    - gochecknoglobals  # no configuration options
+    - nlreturn  # redundant with wsl
+    - paralleltest
+    - revive
+    - thelper
+    - varnamelen
+    - wrapcheck
+
+  settings:
+    cyclop:
+      max-complexity: 12
+
+    funlen:
+      lines: 80
+      statements: 60
+      ignore-comments: true
+
+    ireturn:
+      allow:
+        - error
+        - generic
+
+    lll:
+      line-length: 150
+
+    tagliatelle:
+      case:
+        rules:
+          json: snake
+          yaml: snake
+
+formatters:
   enable:
-    - asasalint
-    - asciicheck
-    - bidichk
-    - bodyclose
-    - canonicalheader
-    - containedctx
-    - contextcheck
-    - copyloopvar
-    - cyclop
-    - decorder
-    - dogsled
-    - dupword
-    - durationcheck
-    - err113
-    - errchkjson
-    - errname
-    - errorlint
-    - exhaustive
-    - fatcontext
-    - forcetypeassert
-    - funlen
-    - gocheckcompilerdirectives
-    - gochecknoinits
-    - gochecknoglobals
-    - gochecknoinits
-    - gocognit
-    - goconst
-    - gocritic
-    - gocyclo
-    - godot
     - gofmt
+    - gofumpt
     - goimports
-    - goprintffuncname
-    - gosec
-    - gosmopolitan
-    - grouper
-    - importas
-    - inamedparam
-    - interfacebloat
-    - intrange
-    - lll
-    - makezero
-    - mirror
-    - misspell
-    - mnd
-    - musttag
-    - nakedret
-    - nestif
-    - nilerr
-    - nilnil
-    - noctx
-    - nolintlint
-    - nonamedreturns
-    - perfsprint
-    - prealloc
-    - predeclared
-    - reassign
-    - rowserrcheck
-    - stylecheck
-    - testpackage
-    - unconvert
-    - unparam
-    - usestdlibvars
-    - wastedassign
-    - whitespace
-    - zerologlint
-
-    # don't enable:
-    # - depguard
-    # - dupl
-    # - exhaustruct
-    # - gci
-    # - ginkgolinter
-    # - gochecknoglobals
-    # - gocognit
-    # - godox
-    # - gofumpt
-    # - gomoddirectives
-    # - ireturn
-    # - lll
-    # - nlreturn
-    # - nolintlint # conflict with 1.19 gofmt changes
-    # - protogetter
-    # - prealloc
-    # - revive
-    # - wsl
-    # - wrapcheck
-
-issues:
-  exclude-rules:
-    - text: "unnamedResult:"
-      linters:
-        - gocritic
+  disable:
+    - gci  # use gofumpt

custom_error_handler.go

@@ -34,7 +34,7 @@ func CustomErrorHandler(
 			continue
 		}
 
-		value, hasErrorMetadata := errInfo.Metadata[HTTPStatusErrorMetadata]
+		value, hasErrorMetadata := errInfo.GetMetadata()[HTTPStatusErrorMetadata]
 		if !hasErrorMetadata {
 			continue
 		}
@@ -48,6 +48,7 @@ func CustomErrorHandler(
 			httpStatusError.Err = err
 			httpStatusError.HTTPStatus = code
 			runtime.DefaultHTTPErrorHandler(ctx, gtw, runtimeMarshaler, httpResponseWriter, httpRequest, &httpStatusError)
+
 			return
 		}
 	}

errors.go

@@ -30,6 +30,7 @@ var (
 func NewAsertoError(code string, statusCode codes.Code, httpCode int, msg string) *AsertoError {
 	asertoError := &AsertoError{code, statusCode, msg, httpCode, map[string]string{}, nil}
 	asertoErrors[code] = asertoError
+
 	return asertoError
 }
 
@@ -88,19 +89,23 @@ func (e *AsertoError) Error() string {
 	}
 
 	innerMessage := errsMessage
+
 	if len(e.data) > 0 {
 		for k, v := range e.data {
 			if k == "msg" {
 				if innerMessage != "" {
 					innerMessage = colon + innerMessage
 				}
+
 				innerMessage = v + innerMessage
 			}
 		}
 	}
+
 	if innerMessage == "" {
 		return fmt.Sprintf("%s %s", e.Code, e.Message)
 	}
+
 	return fmt.Sprintf("%s %s: %s", e.Code, e.Message, innerMessage)
 }
 
@@ -150,30 +155,35 @@ func (e *AsertoError) Msgf(message string, args ...interface{}) *AsertoError {
 	} else {
 		c.data[MessageKey] = message
 	}
+
 	return c
 }
 
 func (e *AsertoError) Str(key, value string) *AsertoError {
 	c := e.Copy()
 	c.data[key] = value
+
 	return c
 }
 
 func (e *AsertoError) Int(key string, value int) *AsertoError {
 	c := e.Copy()
 	c.data[key] = strconv.Itoa(value)
+
 	return c
 }
 
 func (e *AsertoError) Int32(key string, value int32) *AsertoError {
 	c := e.Copy()
 	c.data[key] = strconv.FormatInt(int64(value), 10)
+
 	return c
 }
 
 func (e *AsertoError) Int64(key string, value int64) *AsertoError {
 	c := e.Copy()
 	c.data[key] = strconv.FormatInt(value, 10)
+
 	return c
 }
 
@@ -187,19 +197,21 @@ func (e *AsertoError) Bool(key string, value bool) *AsertoError {
 func (e *AsertoError) Duration(key string, value time.Duration) *AsertoError {
 	c := e.Copy()
 	c.data[key] = value.String()
+
 	return c
 }
 
 func (e *AsertoError) Time(key string, value time.Time) *AsertoError {
 	c := e.Copy()
 	c.data[key] = value.UTC().Format(time.RFC3339)
+
 	return c
 }
 
 func (e *AsertoError) FromReader(key string, value io.Reader) *AsertoError {
 	buf := &strings.Builder{}
-	_, err := io.Copy(buf, value)
-	if err != nil {
+
+	if _, err := io.Copy(buf, value); err != nil {
 		return e.Err(err)
 	}
 
@@ -212,6 +224,7 @@ func (e *AsertoError) FromReader(key string, value io.Reader) *AsertoError {
 func (e *AsertoError) Interface(key string, value interface{}) *AsertoError {
 	c := e.Copy()
 	c.data[key] = fmt.Sprintf("%+v", value)
+
 	return c
 }
 
@@ -242,6 +255,7 @@ func (e *AsertoError) MarshalZerologObject(event *zerolog.Event) {
 
 func (e *AsertoError) GRPCStatus() *status.Status {
 	errResult := status.New(e.StatusCode, e.Message)
+
 	errResult, err := errResult.WithDetails(&errdetails.ErrorInfo{
 		Metadata: e.Data(),
 		Domain:   e.Code,
@@ -256,12 +270,14 @@ func (e *AsertoError) GRPCStatus() *status.Status {
 func (e *AsertoError) WithGRPCStatus(grpcCode codes.Code) *AsertoError {
 	c := e.Copy()
 	c.StatusCode = grpcCode
+
 	return c
 }
 
 func (e *AsertoError) WithHTTPStatus(httpStatus int) *AsertoError {
 	c := e.Copy()
 	c.HTTPCode = httpStatus
+
 	return c
 }
 
@@ -280,12 +296,14 @@ func FromGRPCStatus(grpcStatus status.Status) *AsertoError {
 
 	for _, detail := range grpcStatus.Details() {
 		if t, ok := detail.(*errdetails.ErrorInfo); ok {
-			result = asertoErrors[t.Domain]
+			result = asertoErrors[t.GetDomain()]
 			if result == nil {
 				return nil
 			}
-			result.data = t.Metadata
+
+			result.data = t.GetMetadata()
 		}
+
 		if result != nil {
 			break
 		}
@@ -298,8 +316,10 @@ func FromGRPCStatus(grpcStatus status.Status) *AsertoError {
  * Retrieves the most inner logger associated with an error.
  */
 func Logger(err error) *zerolog.Logger {
-	var logger *zerolog.Logger
-	var ce *ContextError
+	var (
+		logger *zerolog.Logger
+		ce     *ContextError
+	)
 
 	if err == nil {
 		return logger
@@ -384,6 +404,7 @@ func extractLogger(ctx context.Context) *zerolog.Logger {
 	if ctx == nil {
 		return nil
 	}
+
 	logger := zerolog.Ctx(ctx)
 	if logger == zerolog.DefaultContextLogger || logger.GetLevel() == zerolog.Disabled {
 		logger = nil