<commit_before># GOSEC static analysis 
## Background
Gosec (https://github.com/securego/gosec) is a static code analysis tool that scans the code to find security related issues.

Gosec executes a set of validation tests/rules and produces a report listing all the detected potential violations. The set of rules can be configured as well as include and exclude directories. 

## Running gosec in your local environment
To perform gosec scanning over your code run:
```
    make gosec
```
This command will execute all the tests. If you want to run a specific gosec test you can use the `GOSEC` environment variable: E.g.,  `GOSEC="G601`"

## Handle false positive warnings
As a static analysis tool, gosec may produce false positive warnings - identify a potential risk that is not relevant/applicable in the specific KubeVirt code. 
In extreme cases you can annotate the code with a special comment:
```
// #nosec <description>
```
This will instruct gosec to suppress the warning.
The developer is encourage to avoid such annotation when possible as this will silence the warnnings in the line below the comment, even if the code changes and another, true positive issue is created because of that.

### Fixing guidelines
Define a new “safe” function that encapsulate the risky function or code
The safe function name should give good indication on when this function should be used. Whenever possible, the function should validate in-code that the condition really applies.
Annotate the call with a `//#nosec ` comment only within this unsafe function implementation

### Example  
The rule “G304: Potential file inclusion via variable” warns about the risk of unsafe path injection by an attacker. For example, when using `ioutil.ReadFile(fileName)` if an attacker can obtian access to inject/change `fileName`, then using a combination of `/../` (e.g., `fileName="/safe/path/../../private/path"`) he might be able to access private files.

**Suggested fix** 
Define a new "safe” version of `ioutil.ReadFile()` that function will validate that `fileName` is not risky (as much as possible) and then call the "unsafe" original `ioutil.ReadFile()`. Only this call within the "safe" function should be annotated with `// #nosec `.

```
func ValidatePathAndReadFile(filename string) ([]byte, error)
		....
	 	 // Validate that the path is not risky, for example by using filepath.Clean(), detect ".." in filename, etc..
		
		....
    	 // #nosec using exec.Command only for non injectable parameters
		 return		 ioutil.ReadFile(filename)
}
```<commit_msg>Update gosec.md<commit_after># GOSEC static analysis 
## Background
Gosec (https://github.com/securego/gosec) is a static code analysis tool that scans the code to find security related issues.

Gosec executes a set of validation tests/rules and produces a report listing all the detected potential violations. The set of rules can be configured as well as include and exclude directories. 

## Running gosec in your local environment
To perform gosec scanning over your code run:
```
    make gosec
```
This command will execute all the tests. If you want to run a specific gosec test you can use the `GOSEC` environment variable: E.g.,  `GOSEC="G601`"

## Handle false positive warnings
As a static analysis tool, gosec may produce false positive warnings - identify a potential risk that is not relevant/applicable in the specific KubeVirt code. 
In extreme cases you can annotate the code with a special comment:
```
// #nosec <description>
```
This will instruct gosec to suppress the warning.
The developer is encourage to avoid such annotation when possible as this will silence the warnnings in the line below the comment, even if the code changes and another, true positive issue is created because of that.

### Fixing guidelines
Define a new “safe” function that encapsulate the risky function or code
The safe function name should give good indication on when this function should be used. Whenever possible, the function should validate in-code that the condition really applies.
Annotate the call with a `//#nosec ` comment only within this unsafe function implementation

### Example  
The rule “G304: Potential file inclusion via variable” warns about the risk of unsafe path injection by an attacker. For example, when using `ioutil.ReadFile(fileName)` if an attacker can obtian access to inject/change `fileName`, then using a combination of `/../` (e.g., `fileName="/safe/path/../../private/path"`) he might be able to access private files.

**Suggested fix** 
Define a new "safe” version of `ioutil.ReadFile()` that function will validate that `fileName` is not risky (as much as possible) and then call the "unsafe" original `ioutil.ReadFile()`. Only this call within the "safe" function should be annotated with `// #nosec `.

```
func ValidatePathAndReadFile(filename string) ([]byte, error)
	...
 	 // Validate that the path is not risky, for example by using filepath.Clean(), detect ".." in filename, etc..
		
	...
     // #nosec using ioutil.ReadFile only for safe file path
	 return  ioutil.ReadFile(filename)
}
```
{'fraction_non_alphanumeric': 0.07549019607843137, 'fraction_numerical': 0.002352941176470588, 'mean_word_length': 4.264189886480908, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1490941', 'n_tokens_mistral': 1347, 'n_tokens_neox': 1264, 'n_words': 713}