RHINENG-13300: fix disabled gosec rules

base/mqueue/mqueue_impl_gokafka.go

@@ -121,6 +121,7 @@ func tryCreateSecuredDialerFromEnv() *kafka.Dialer {
 	}
 
 	kafkaSslSkipVerify := utils.CoreCfg.KafkaSslSkipVerify
+	// used only in development mode
 	tlsConfig := &tls.Config{InsecureSkipVerify: kafkaSslSkipVerify} // nolint:gosec
 	if !kafkaSslSkipVerify {
 		tlsConfig = caCertTLSConfig()
@@ -178,6 +179,6 @@ func caCertTLSConfig() *tls.Config {
 		}
 		caCertPool.AppendCertsFromPEM(caCert)
 	}
-	tlsConfig := tls.Config{RootCAs: caCertPool} // nolint:gosec
+	tlsConfig := tls.Config{RootCAs: caCertPool, MinVersion: tls.VersionTLS12}
 	return &tlsConfig
 }

base/utils/http.go

@@ -10,6 +10,7 @@ import (
 	"github.com/lestrrat-go/backoff"
 	"github.com/pkg/errors"
 
+	// used only in developer mode
 	_ "net/http/pprof" //nolint:gosec
 )
 
@@ -119,7 +120,8 @@ func statusCodeFound(response *http.Response, statusCodes []int) bool {
 func RunProfiler() {
 	if CoreCfg.ProfilerEnabled {
 		go func() {
-			err := http.ListenAndServe(fmt.Sprintf(":%d", CoreCfg.PrivatePort), nil) //nolint:gosec
+			server := &http.Server{Addr: fmt.Sprintf(":%d", CoreCfg.PrivatePort), ReadHeaderTimeout: 120 * time.Second}
+			err := server.ListenAndServe()
 			if err != nil {
 				LogWarn("err", err.Error(), "couldn't start profiler")
 			}

database_admin/schema_test.go

@@ -27,6 +27,18 @@ func setCmdAuth(cmd *exec.Cmd) {
 	cmd.Env = append(cmd.Env, fmt.Sprintf("PGPASSWORD=%v", utils.FailIfEmpty(utils.CoreCfg.DBPassword, "DB_PASSWD")))
 }
 
+func writeTemp(dir, filename string, data []byte) {
+	file, err := os.CreateTemp(dir, filename)
+	if err != nil {
+		utils.LogError(err)
+		return
+	}
+	if _, err := file.Write(data); err != nil {
+		utils.LogError(err)
+	}
+	file.Close()
+}
+
 func TestSchemaCompatiblity(t *testing.T) {
 	utils.SkipWithoutDB(t)
 	cfg := postgres.Config{
@@ -75,15 +87,10 @@ func TestSchemaCompatiblity(t *testing.T) {
 	diff, err := difflib.GetUnifiedDiffString(difflib.UnifiedDiff{A: migratedLines, B: scratchLines})
 	assert.NoError(t, err)
 
-	// nolint:gosec
 	if len(diff) > 0 {
 		fmt.Print(diff)
-		if err := os.WriteFile("/tmp/schema-1-migrated.dump", migrated, 0600); err != nil {
-			utils.LogError(err)
-		}
-		if err := os.WriteFile("/tmp/schema-2-fromscratch.dump", fromScratch, 0600); err != nil {
-			utils.LogError(err)
-		}
+		writeTemp("/tmp", "schema-1-migrated.*.dump", migrated)
+		writeTemp("/tmp", "schema-2-fromscratch.*.dump", fromScratch)
 	}
 	assert.Equal(t, len(diff), 0)
 }

platform/inventory.go

@@ -3,7 +3,8 @@ package platform
 import (
 	"app/base/inventory"
 	"app/base/utils"
-	"math/rand"
+	"crypto/rand"
+	"math/big"
 )
 
 var pkgs = []string{
@@ -28,15 +29,14 @@ var pkgs = []string{
 	"iproute-2.6.18-13.el5.i386",
 	"libbonobo-2.24.2-5.el6.i686"}
 
-// nolint: gosec
 // Create bare system profile
 func makeSystemProfile(id string, randomPkgs bool) inventory.SystemProfile {
 	_pkgs := pkgs
 	if id == "TEST-NO-PKGS" {
 		_pkgs = []string{}
 	} else if randomPkgs {
-		nPkgs := rand.Intn(len(pkgs))
-		_pkgs = pkgs[0:nPkgs]
+		nPkgs, _ := rand.Int(rand.Reader, big.NewInt(int64(len(pkgs))))
+		_pkgs = pkgs[0:nPkgs.Int64()]
 	}
 
 	yumRepos := []inventory.YumRepo{