From 45a542e46ac2646039c2151a4e9406b12f8be9d0 Mon Sep 17 00:00:00 2001 From: Quang Hieu Le Date: Thu, 20 Feb 2025 22:53:55 -0500 Subject: [PATCH 01/12] Remove G115 from excludes list for gosec Signed-off-by: Quang Hieu Le --- .golangci.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.golangci.yml b/.golangci.yml index 85ea11dce114..a06e0c4be0cb 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -70,7 +70,6 @@ linters-settings: excludes: - G104 # G104: Errors unhandled; (TODO: reduce unhandled errors, or explicitly ignore) - G113 # G113: Potential uncontrolled memory consumption in Rat.SetString (CVE-2022-23772); (only affects go < 1.16.14. and go < 1.17.7) - - G115 # G115: integer overflow conversion; (TODO: verify these: https://github.com/docker/cli/issues/5584) - G306 # G306: Expect WriteFile permissions to be 0600 or less (too restrictive; also flags "0o644" permissions) - G307 # G307: Deferring unsafe method "*os.File" on type "Close" (also EXC0008); (TODO: evaluate these and fix where needed: G307: Deferring unsafe method "*os.File" on type "Close") govet: From cf3e9e13f811caa697dd63e84cba031c58a13477 Mon Sep 17 00:00:00 2001 From: Quang Hieu Le Date: Thu, 20 Feb 2025 23:01:54 -0500 Subject: [PATCH 02/12] Verified int conversion for port.go Currently all known port number is in the range of int32, where the conversion within this file is usually a reduction (uint64 -> uint32), or expansion (int16 -> uint32), so the change of port number or related number overflowing is near 0. This makes nolint for gosec safe to append to the conversion within this file. Signed-off-by: Quang Hieu Le --- opts/port.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/opts/port.go b/opts/port.go index 0407355e65ff..f1fa0df0d5bd 100644 --- a/opts/port.go +++ b/opts/port.go @@ -163,8 +163,8 @@ func ConvertPortToPortConfig( ports = append(ports, swarm.PortConfig{ // TODO Name: ? Protocol: swarm.PortConfigProtocol(strings.ToLower(port.Proto())), - TargetPort: uint32(port.Int()), - PublishedPort: uint32(i), + TargetPort: uint32(port.Int()), //nolint:gosec + PublishedPort: uint32(i), //nolint:gosec PublishMode: swarm.PortConfigPublishModeIngress, }) } From e9de3b0419bdf484aae687f2c2b9dade254835de Mon Sep 17 00:00:00 2001 From: Quang Hieu Le Date: Fri, 21 Feb 2025 14:18:21 -0500 Subject: [PATCH 03/12] Verify G115 warning for logs.go Replicas arg from Client does not currently have min/max number, but is accepted as uint64 (max 2^64 - 1), where int is a dynamic type (32 or 64 bit), assuming there is someone is willing to create 2^32 replicas, this library would be in a bigger trouble. Signed-off-by: Quang Hieu Le --- cli/command/service/logs.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cli/command/service/logs.go b/cli/command/service/logs.go index 00b8562ca469..4d442a045b4a 100644 --- a/cli/command/service/logs.go +++ b/cli/command/service/logs.go @@ -121,7 +121,7 @@ func runLogs(ctx context.Context, dockerCli command.Cli, opts *logsOptions) erro if service.Spec.Mode.Replicated != nil && service.Spec.Mode.Replicated.Replicas != nil { // if replicas are initialized, figure out if we need to pad them replicas := *service.Spec.Mode.Replicated.Replicas - maxLength = getMaxLength(int(replicas)) + maxLength = getMaxLength(int(replicas)) //nolint:gosec } } From 9996347a855ae3f52371f5a02629f10237c237e6 Mon Sep 17 00:00:00 2001 From: Quang Hieu Le Date: Fri, 21 Feb 2025 14:43:40 -0500 Subject: [PATCH 04/12] Verified inline int to uint64 conversion In both cases where int be 64 or 32 byte, this can be considered to be an expansion conversion (32 to 64 or 64 signed to 64 unsigned), which would not cause overflow Signed-off-by: Quang Hieu Le --- cli/command/service/progress/progress.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cli/command/service/progress/progress.go b/cli/command/service/progress/progress.go index 09da18774c7a..8fd2f72102cf 100644 --- a/cli/command/service/progress/progress.go +++ b/cli/command/service/progress/progress.go @@ -383,7 +383,7 @@ func (*replicatedProgressUpdater) tasksBySlot(tasks []swarm.Task, activeNodes ma } func (u *replicatedProgressUpdater) writeTaskProgress(task swarm.Task, mappedSlot int, replicas uint64) { - if u.done || replicas > maxProgressBars || uint64(mappedSlot) > replicas { + if u.done || replicas > maxProgressBars || uint64(mappedSlot) > replicas { //nolint:gosec return } From d2b15b5d0cc6ee48590d394e5045cbf8d14818b8 Mon Sep 17 00:00:00 2001 From: Quang Hieu Le Date: Fri, 21 Feb 2025 23:00:56 -0500 Subject: [PATCH 05/12] Verify container opts.go for G115 lint warning Currently the warning is there for conversion from int64 to uint64, regarding MemBytes flag (128M, 2G). While int64 allows negative value, the actual value that is passing for this flag cannot be negative due to the concept of negative memory does not exist (as far as the author know). At the same time, int64 and uint64 has the same byte size, so this conversion won't cause overflow. Signed-off-by: Quang Hieu Le --- cli/command/container/opts.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cli/command/container/opts.go b/cli/command/container/opts.go index 8cc44b762da9..cafe20336179 100644 --- a/cli/command/container/opts.go +++ b/cli/command/container/opts.go @@ -620,7 +620,7 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con BlkioDeviceReadIOps: copts.deviceReadIOps.GetList(), BlkioDeviceWriteIOps: copts.deviceWriteIOps.GetList(), IOMaximumIOps: copts.ioMaxIOps, - IOMaximumBandwidth: uint64(copts.ioMaxBandwidth), + IOMaximumBandwidth: uint64(copts.ioMaxBandwidth), //nolint:gosec Ulimits: copts.ulimits.GetList(), DeviceCgroupRules: copts.deviceCgroupRules.GetAll(), Devices: deviceMappings, From 50e640ed8c6aeb8e5f71d15477910f9aad18d6e2 Mon Sep 17 00:00:00 2001 From: Quang Hieu Le Date: Sun, 23 Feb 2025 12:08:14 -0500 Subject: [PATCH 06/12] Verified container/cp.go for G115 lint Since len always return positive int, there's no need to concern about signed int, so the int conversion overflow warning from int -> uint can be ignored/skipped Signed-off-by: Quang Hieu Le --- cli/command/container/cp.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cli/command/container/cp.go b/cli/command/container/cp.go index 85e9f6164f2c..8cc5c74efa59 100644 --- a/cli/command/container/cp.go +++ b/cli/command/container/cp.go @@ -108,7 +108,7 @@ func copyProgress(ctx context.Context, dst io.Writer, header string, total *int6 } // Write to the buffer first to avoid flickering and context switching - fmt.Fprint(buf, aec.Column(uint(len(header)+1))) + fmt.Fprint(buf, aec.Column(uint(len(header)+1))) //nolint:gosec fmt.Fprint(buf, aec.EraseLine(aec.EraseModes.Tail)) fmt.Fprint(buf, progressHumanSize(n)) From 99614d043eb3ab6865cdc2f2e2b7dbd80542b5cb Mon Sep 17 00:00:00 2001 From: Quang Hieu Le Date: Sun, 23 Feb 2025 12:50:53 -0500 Subject: [PATCH 07/12] Refactored image/tree.go for G115 Changing adjustColumn arg from accepting uint to int for more versatile usage, rather than the reverse, accepting uint and then convert back to int. This pushes the responsibility to realign, double check data prior to using this function to the client side, Signed-off-by: Quang Hieu Le --- cli/command/image/tree.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/cli/command/image/tree.go b/cli/command/image/tree.go index a095173bd7d3..f40c84f435d7 100644 --- a/cli/command/image/tree.go +++ b/cli/command/image/tree.go @@ -259,7 +259,7 @@ func printImageTree(dockerCLI command.Cli, view treeView) error { }, } - columns = adjustColumns(width, columns, view.images) + columns = adjustColumns(int(width), columns, view.images) //nolint:gosec // Print columns for i, h := range columns { @@ -289,8 +289,8 @@ func printImageTree(dockerCLI command.Cli, view treeView) error { // adjustColumns adjusts the width of the first column to maximize the space // available for image names and removes any columns that would be too narrow // to display their content. -func adjustColumns(width uint, columns []imgColumn, images []topImage) []imgColumn { - nameWidth := int(width) +func adjustColumns(width int, columns []imgColumn, images []topImage) []imgColumn { + nameWidth := width for idx, h := range columns { if h.Width == 0 { continue From 350a94c6da81b65aee137d0f9a6f890a4b122108 Mon Sep 17 00:00:00 2001 From: Quang Hieu Le Date: Sun, 23 Feb 2025 13:01:01 -0500 Subject: [PATCH 08/12] Verified other conversion from uint to int in image/tree.go All of this conversion is safe due to changing from unsigned to signed bits, but also including a refactor to changing the arg of a function from handling uint to int, and push the conversion to the caller funcion instead. Signed-off-by: Quang Hieu Le --- cli/command/image/tree.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/cli/command/image/tree.go b/cli/command/image/tree.go index f40c84f435d7..34ad3a79b058 100644 --- a/cli/command/image/tree.go +++ b/cli/command/image/tree.go @@ -193,7 +193,7 @@ func printImageTree(dockerCLI command.Cli, view treeView) error { out.PrintlnWithColor(tui.ColorWarning, "WARNING: This is an experimental feature. The output may change and shouldn't be depended on.") - out.Println(generateLegend(out, width)) + out.Println(generateLegend(out, int(width))) //nolint: gosec out.Println() possibleChips := getPossibleChips(view) @@ -316,7 +316,7 @@ func adjustColumns(width int, columns []imgColumn, images []topImage) []imgColum return columns } -func generateLegend(out tui.Output, width uint) string { +func generateLegend(out tui.Output, width int) string { var legend string legend += out.Sprint(tui.InfoHeader) for idx, chip := range allChips { @@ -327,7 +327,7 @@ func generateLegend(out tui.Output, width uint) string { } legend += " " - r := int(width) - tui.Width(legend) + r := width - tui.Width(legend) if r < 0 { r = 0 } @@ -388,7 +388,7 @@ func printNames(out tui.Output, headers []imgColumn, img topImage, color, untagg // name will be printed alongside other columns. if nameIdx < len(img.Names)-1 { _, fullWidth := out.GetTtySize() - _, _ = fmt.Fprintln(out, color.Apply(tui.Ellipsis(name, int(fullWidth)))) + _, _ = fmt.Fprintln(out, color.Apply(tui.Ellipsis(name, int(fullWidth)))) //nolint:gosec } else { _, _ = fmt.Fprint(out, headers[0].Print(color, name)) } From b0eeff49e8c28bd1d7b81d86ff2137821abc78ce Mon Sep 17 00:00:00 2001 From: Quang Hieu Le Date: Sun, 23 Feb 2025 13:22:16 -0500 Subject: [PATCH 09/12] Adding early exit for stats_helper Previously the calculation within this function convert int64 to uint64 right off the bat, by adding an early exit while preRead is smaller or equal to 0, not only we don't need nolint but also avoid having to divide by 0 and further calculation with 0. Signed-off-by: Quang Hieu Le --- cli/command/container/stats_helpers.go | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/cli/command/container/stats_helpers.go b/cli/command/container/stats_helpers.go index c7084c17b532..2c47956c9d72 100644 --- a/cli/command/container/stats_helpers.go +++ b/cli/command/container/stats_helpers.go @@ -184,9 +184,13 @@ func calculateCPUPercentUnix(previousCPU, previousSystem uint64, v *container.St func calculateCPUPercentWindows(v *container.StatsResponse) float64 { // Max number of 100ns intervals between the previous time read and now - possIntervals := uint64(v.Read.Sub(v.PreRead).Nanoseconds()) // Start with number of ns intervals - possIntervals /= 100 // Convert to number of 100ns intervals - possIntervals *= uint64(v.NumProcs) // Multiple by the number of processors + preRead := v.Read.Sub(v.PreRead).Nanoseconds() + if preRead <= 0 { + return 0.00 // Avoid calculation with 0 or negative + } + possIntervals := uint64(preRead) // Start with number of ns intervals + possIntervals /= 100 // Convert to number of 100ns intervals + possIntervals *= uint64(v.NumProcs) // Multiple by the number of processors // Intervals used intervalsUsed := v.CPUStats.CPUUsage.TotalUsage - v.PreCPUStats.CPUUsage.TotalUsage From ec1b992e4e1e985a5fbfdd94a94b47c2e8ce1d6e Mon Sep 17 00:00:00 2001 From: Quang Hieu Le Date: Sun, 23 Feb 2025 13:43:59 -0500 Subject: [PATCH 10/12] Validated convert/service.go for G115 warning For policy.MaximumRetryCount, there exist another validation in container/hostconfig.go to validate for any invalid value smaller or equal than 0, making this safe to convert from int to uint64. Regarding healthcheck.Retries, the two case where this might fail is when docker is running in a 32bit system, and someone set retries to be 2^32 or larger, which the chance is extremely low. Signed-off-by: Quang Hieu Le --- cli/compose/convert/service.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cli/compose/convert/service.go b/cli/compose/convert/service.go index d5237d72912b..6c98deb7a534 100644 --- a/cli/compose/convert/service.go +++ b/cli/compose/convert/service.go @@ -461,7 +461,7 @@ func convertHealthcheck(healthcheck *composetypes.HealthCheckConfig) (*container startInterval = time.Duration(*healthcheck.StartInterval) } if healthcheck.Retries != nil { - retries = int(*healthcheck.Retries) + retries = int(*healthcheck.Retries) //nolint:gosec } return &container.HealthConfig{ Test: healthcheck.Test, @@ -488,7 +488,7 @@ func convertRestartPolicy(restart string, source *composetypes.RestartPolicy) (* Condition: swarm.RestartPolicyConditionAny, }, nil case policy.IsOnFailure(): - attempts := uint64(policy.MaximumRetryCount) + attempts := uint64(policy.MaximumRetryCount) //nolint:gosec return &swarm.RestartPolicy{ Condition: swarm.RestartPolicyConditionOnFailure, MaxAttempts: &attempts, From 5868837a7240abb5f637a80b53ae764e5c36d906 Mon Sep 17 00:00:00 2001 From: Quang Hieu Le Date: Tue, 25 Feb 2025 12:04:53 -0500 Subject: [PATCH 11/12] Verify G115 warning in progress.go Most of the issue here is either converting from uint64 to int or int64 to int. Since int is dependent on the system it's using, the only case where it gets overflow is when Docker is being used on a 32bits system, and when the number of process reaches over 2^32 - 1, or when the total process reaches beyond the previous mentioned limit. More validating can be checked before it reaches this point, but should not be implemented within this issue. Signed-off-by: Quang Hieu Le --- cli/command/service/progress/progress.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/cli/command/service/progress/progress.go b/cli/command/service/progress/progress.go index 8fd2f72102cf..4e0c3379b6c4 100644 --- a/cli/command/service/progress/progress.go +++ b/cli/command/service/progress/progress.go @@ -301,7 +301,7 @@ func (u *replicatedProgressUpdater) update(service swarm.Service, tasks []swarm. u.slotMap = make(map[int]int) // Draw progress bars in order - writeOverallProgress(u.progressOut, 0, int(replicas), rollback) + writeOverallProgress(u.progressOut, 0, int(replicas), rollback) //nolint:gosec if replicas <= maxProgressBars { for i := uint64(1); i <= replicas; i++ { @@ -340,7 +340,7 @@ func (u *replicatedProgressUpdater) update(service swarm.Service, tasks []swarm. } if !u.done { - writeOverallProgress(u.progressOut, int(running), int(replicas), rollback) + writeOverallProgress(u.progressOut, int(running), int(replicas), rollback) //nolint:gosec if running == replicas { u.done = true @@ -572,8 +572,8 @@ type replicatedJobProgressUpdater struct { } func newReplicatedJobProgressUpdater(service swarm.Service, progressOut progress.Output) *replicatedJobProgressUpdater { - concurrent := int(*service.Spec.Mode.ReplicatedJob.MaxConcurrent) - total := int(*service.Spec.Mode.ReplicatedJob.TotalCompletions) + concurrent := int(*service.Spec.Mode.ReplicatedJob.MaxConcurrent) //nolint:gosec + total := int(*service.Spec.Mode.ReplicatedJob.TotalCompletions) //nolint:gosec return &replicatedJobProgressUpdater{ progressOut: progressOut, From 3a08feb23d9d3ccf85637dbf303bd3d785b03066 Mon Sep 17 00:00:00 2001 From: Quang Hieu Le Date: Thu, 27 Feb 2025 10:50:17 -0500 Subject: [PATCH 12/12] Change nolint syntax to nosec for specification Changing syntaxes for all previous nolint comment to narrow down false positive statement to only excluding G115 rules, avoid skipping other gosec validation. Signed-off-by: Quang Hieu Le --- cli/command/container/cp.go | 2 +- cli/command/container/opts.go | 2 +- cli/command/image/tree.go | 6 +++--- cli/command/service/logs.go | 2 +- cli/command/service/progress/progress.go | 11 ++++++----- cli/compose/convert/service.go | 5 +++-- opts/port.go | 4 ++-- 7 files changed, 17 insertions(+), 15 deletions(-) diff --git a/cli/command/container/cp.go b/cli/command/container/cp.go index 8cc5c74efa59..e70429c0a205 100644 --- a/cli/command/container/cp.go +++ b/cli/command/container/cp.go @@ -108,7 +108,7 @@ func copyProgress(ctx context.Context, dst io.Writer, header string, total *int6 } // Write to the buffer first to avoid flickering and context switching - fmt.Fprint(buf, aec.Column(uint(len(header)+1))) //nolint:gosec + fmt.Fprint(buf, aec.Column(uint(len(header)+1))) // #nosec G115 -- Ignore "integer overflow conversion int -> uint" (go len value always start from 0) fmt.Fprint(buf, aec.EraseLine(aec.EraseModes.Tail)) fmt.Fprint(buf, progressHumanSize(n)) diff --git a/cli/command/container/opts.go b/cli/command/container/opts.go index cafe20336179..14cf7797dd8b 100644 --- a/cli/command/container/opts.go +++ b/cli/command/container/opts.go @@ -620,7 +620,7 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con BlkioDeviceReadIOps: copts.deviceReadIOps.GetList(), BlkioDeviceWriteIOps: copts.deviceWriteIOps.GetList(), IOMaximumIOps: copts.ioMaxIOps, - IOMaximumBandwidth: uint64(copts.ioMaxBandwidth), //nolint:gosec + IOMaximumBandwidth: uint64(copts.ioMaxBandwidth), // #nosec G115 -- ignore "integer overflow conversion int64 -> uint64" (Using MemBytes value, which alway assumed to be positive) Ulimits: copts.ulimits.GetList(), DeviceCgroupRules: copts.deviceCgroupRules.GetAll(), Devices: deviceMappings, diff --git a/cli/command/image/tree.go b/cli/command/image/tree.go index 34ad3a79b058..a57d2612c700 100644 --- a/cli/command/image/tree.go +++ b/cli/command/image/tree.go @@ -193,7 +193,7 @@ func printImageTree(dockerCLI command.Cli, view treeView) error { out.PrintlnWithColor(tui.ColorWarning, "WARNING: This is an experimental feature. The output may change and shouldn't be depended on.") - out.Println(generateLegend(out, int(width))) //nolint: gosec + out.Println(generateLegend(out, int(width))) // #nosec G115 -- ignore "overflow conversion uint -> int", int expansion won't cause lost of value out.Println() possibleChips := getPossibleChips(view) @@ -259,7 +259,7 @@ func printImageTree(dockerCLI command.Cli, view treeView) error { }, } - columns = adjustColumns(int(width), columns, view.images) //nolint:gosec + columns = adjustColumns(int(width), columns, view.images) // #nosec G115 -- ignore "overflow conversion uint -> int", int expansion won't cause lost of value // Print columns for i, h := range columns { @@ -388,7 +388,7 @@ func printNames(out tui.Output, headers []imgColumn, img topImage, color, untagg // name will be printed alongside other columns. if nameIdx < len(img.Names)-1 { _, fullWidth := out.GetTtySize() - _, _ = fmt.Fprintln(out, color.Apply(tui.Ellipsis(name, int(fullWidth)))) //nolint:gosec + _, _ = fmt.Fprintln(out, color.Apply(tui.Ellipsis(name, int(fullWidth)))) // #nosec G115 -- ignore "overflow conversion uint -> int", int expansion won't cause lost of value } else { _, _ = fmt.Fprint(out, headers[0].Print(color, name)) } diff --git a/cli/command/service/logs.go b/cli/command/service/logs.go index 4d442a045b4a..2179f180fd2d 100644 --- a/cli/command/service/logs.go +++ b/cli/command/service/logs.go @@ -121,7 +121,7 @@ func runLogs(ctx context.Context, dockerCli command.Cli, opts *logsOptions) erro if service.Spec.Mode.Replicated != nil && service.Spec.Mode.Replicated.Replicas != nil { // if replicas are initialized, figure out if we need to pad them replicas := *service.Spec.Mode.Replicated.Replicas - maxLength = getMaxLength(int(replicas)) //nolint:gosec + maxLength = getMaxLength(int(replicas)) // #nosec G115 -- ignore "integer overflow conversion uint64 -> int" (The only fail case is having 2^32 or more replicas on 32bit system) } } diff --git a/cli/command/service/progress/progress.go b/cli/command/service/progress/progress.go index 4e0c3379b6c4..41b34b92d85c 100644 --- a/cli/command/service/progress/progress.go +++ b/cli/command/service/progress/progress.go @@ -301,7 +301,7 @@ func (u *replicatedProgressUpdater) update(service swarm.Service, tasks []swarm. u.slotMap = make(map[int]int) // Draw progress bars in order - writeOverallProgress(u.progressOut, 0, int(replicas), rollback) //nolint:gosec + writeOverallProgress(u.progressOut, 0, int(replicas), rollback) // #nosec G115 -- ignore "overflow conversion uint64 -> int", safe for less than 2^32 replica in 32bit system if replicas <= maxProgressBars { for i := uint64(1); i <= replicas; i++ { @@ -340,7 +340,7 @@ func (u *replicatedProgressUpdater) update(service swarm.Service, tasks []swarm. } if !u.done { - writeOverallProgress(u.progressOut, int(running), int(replicas), rollback) //nolint:gosec + writeOverallProgress(u.progressOut, int(running), int(replicas), rollback) // #nosec G115 -- ignore "overflow conversion uint64 -> int", safe for less than 2^32 running tasks in 32bit system if running == replicas { u.done = true @@ -383,7 +383,8 @@ func (*replicatedProgressUpdater) tasksBySlot(tasks []swarm.Task, activeNodes ma } func (u *replicatedProgressUpdater) writeTaskProgress(task swarm.Task, mappedSlot int, replicas uint64) { - if u.done || replicas > maxProgressBars || uint64(mappedSlot) > replicas { //nolint:gosec + // #nosec G115 -- ignore "overflow conversion uint64 -> int", mappedSlot never negative + if u.done || replicas > maxProgressBars || uint64(mappedSlot) > replicas { return } @@ -572,8 +573,8 @@ type replicatedJobProgressUpdater struct { } func newReplicatedJobProgressUpdater(service swarm.Service, progressOut progress.Output) *replicatedJobProgressUpdater { - concurrent := int(*service.Spec.Mode.ReplicatedJob.MaxConcurrent) //nolint:gosec - total := int(*service.Spec.Mode.ReplicatedJob.TotalCompletions) //nolint:gosec + concurrent := int(*service.Spec.Mode.ReplicatedJob.MaxConcurrent) // #nosec G115 -- ignore "overflow conversion uint64 -> int", safe for less than 2^32 MaxConcurrent in 32bit system + total := int(*service.Spec.Mode.ReplicatedJob.TotalCompletions) // #nosec G115 -- ignore "overflow conversion uint64 -> int", safe for less than 2^32 TotalCompletions in 32bit system return &replicatedJobProgressUpdater{ progressOut: progressOut, diff --git a/cli/compose/convert/service.go b/cli/compose/convert/service.go index 6c98deb7a534..77434dc9b6f2 100644 --- a/cli/compose/convert/service.go +++ b/cli/compose/convert/service.go @@ -460,8 +460,9 @@ func convertHealthcheck(healthcheck *composetypes.HealthCheckConfig) (*container if healthcheck.StartInterval != nil { startInterval = time.Duration(*healthcheck.StartInterval) } + // #nosec G115 -- ignore "overflow conversion uint64 -> int", safe to convert for retries value less than 2^32 in a 32bit system if healthcheck.Retries != nil { - retries = int(*healthcheck.Retries) //nolint:gosec + retries = int(*healthcheck.Retries) } return &container.HealthConfig{ Test: healthcheck.Test, @@ -488,7 +489,7 @@ func convertRestartPolicy(restart string, source *composetypes.RestartPolicy) (* Condition: swarm.RestartPolicyConditionAny, }, nil case policy.IsOnFailure(): - attempts := uint64(policy.MaximumRetryCount) //nolint:gosec + attempts := uint64(policy.MaximumRetryCount) // #nosec G115 -- ignore "overflow onversion int -> uint64", validation for negative value exist on MaximumRetryCount init return &swarm.RestartPolicy{ Condition: swarm.RestartPolicyConditionOnFailure, MaxAttempts: &attempts, diff --git a/opts/port.go b/opts/port.go index f1fa0df0d5bd..3eea1ba238ab 100644 --- a/opts/port.go +++ b/opts/port.go @@ -163,8 +163,8 @@ func ConvertPortToPortConfig( ports = append(ports, swarm.PortConfig{ // TODO Name: ? Protocol: swarm.PortConfigProtocol(strings.ToLower(port.Proto())), - TargetPort: uint32(port.Int()), //nolint:gosec - PublishedPort: uint32(i), //nolint:gosec + TargetPort: uint32(port.Int()), // #nosec G115 -- ignore "integer overflow conversion int -> uint32" (All known port is in range of uint32, including dynamic port) + PublishedPort: uint32(i), // #nosec G115 -- ignore "integer overflow conversion uint64 -> uint32" (All known port is in range of uint32, including dynamic port) PublishMode: swarm.PortConfigPublishModeIngress, }) }