Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[exporter/elasticsearch] [chore] fix lint issues with golangci-lint 1.62 #36798

Merged
merged 15 commits into from
Dec 14, 2024

Conversation

dmathieu
Copy link
Member

@dmathieu dmathieu commented Dec 12, 2024

Description

The golangci-lint upgrades causes a lot gosec issues due to a new check for integer conversion overflow.
This PR checks for integer overflows within the elasticsearch exporter package.

Link to tracking issue

Related: #36638

@dmathieu dmathieu marked this pull request as ready for review December 12, 2024 11:20
@dmathieu dmathieu requested a review from a team as a code owner December 12, 2024 11:20
@dmathieu dmathieu requested a review from ChrsMark December 12, 2024 11:20
@dmathieu
Copy link
Member Author

cc @TylerHelmuth since you're self-assigned the dependabot PR.


func safeUint64ToInt64(v uint64) int64 {
if v > math.MaxInt64 {
return math.MaxInt64
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This results in wrong values without notifying the user.
IMO, we can't just silently go on with modified count values here.
Or it needs to documented very well.

Copy link
Member Author

@dmathieu dmathieu Dec 12, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that an unchecked overflow will already send wrong values. We're chosing to send the highest maximum value rather than a negative number which would be even more confusing.

I don't mind adding some logging, but I haven't found any such precedent within the package.
And for that log line to be useful and not just cause more noise, we'd have to be able to correlate it to a specific document ID.

@dmathieu dmathieu force-pushed the elasticsearchexporter-gosec branch from 5d6437b to b250f87 Compare December 12, 2024 11:36
@@ -1245,7 +1245,7 @@ func TestEncodeLogBodyMapMode(t *testing.T) {
resourceLogs := logs.ResourceLogs().AppendEmpty()
scopeLogs := resourceLogs.ScopeLogs().AppendEmpty()
logRecords := scopeLogs.LogRecords()
observedTimestamp := pcommon.Timestamp(time.Now().UnixNano())
observedTimestamp := pcommon.Timestamp(time.Now().UnixNano()) // nolint:gosec // UnixNano is positive and thus safe to convert to signed integer.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, messed up

Suggested change
observedTimestamp := pcommon.Timestamp(time.Now().UnixNano()) // nolint:gosec // UnixNano is positive and thus safe to convert to signed integer.
observedTimestamp := pcommon.Timestamp(time.Now().UnixNano()) // nolint:gosec // UnixNano is positive and thus safe to convert to unsigned integer.

Copy link
Member

@ChrsMark ChrsMark left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@dmitryax dmitryax merged commit 5e36f55 into open-telemetry:main Dec 14, 2024
160 checks passed
@github-actions github-actions bot added this to the next release milestone Dec 14, 2024
@dmathieu dmathieu deleted the elasticsearchexporter-gosec branch December 14, 2024 14:55
sbylica-splunk pushed a commit to sbylica-splunk/opentelemetry-collector-contrib that referenced this pull request Dec 17, 2024
….62 (open-telemetry#36798)

#### Description

The golangci-lint upgrades causes a lot gosec issues due to a new check
for integer conversion overflow.
This PR checks for integer overflows within the elasticsearch exporter
package.


#### Link to tracking issue
Related:
open-telemetry#36638

---------

Co-authored-by: Carson Ip <[email protected]>
Co-authored-by: Tim Rühsen <[email protected]>
Co-authored-by: Christos Markou <[email protected]>
mterhar pushed a commit to mterhar/opentelemetry-collector-contrib that referenced this pull request Dec 19, 2024
….62 (open-telemetry#36798)

#### Description

The golangci-lint upgrades causes a lot gosec issues due to a new check
for integer conversion overflow.
This PR checks for integer overflows within the elasticsearch exporter
package.


#### Link to tracking issue
Related:
open-telemetry#36638

---------

Co-authored-by: Carson Ip <[email protected]>
Co-authored-by: Tim Rühsen <[email protected]>
Co-authored-by: Christos Markou <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants