From 5f4eb9f9d04673289bf74f84344d0f3db1976dfe Mon Sep 17 00:00:00 2001
From: wucm667 <stevenwucongmin@gmail.com>
Date: Fri, 13 Feb 2026 10:48:33 +0800
Subject: [PATCH] =?UTF-8?q?chore:=20=E9=85=8D=E7=BD=AE=20gosec=20=E6=8E=92?=
 =?UTF-8?q?=E9=99=A4=E8=A7=84=E5=88=99?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 新增 backend/.gosec.yaml 配置文件，排除 G704 (SSRF) 检查
- 更新 security-scan.yml workflow，使用 gosec 配置文件
- 原因：作为 API 网关平台，需要代理请求到配置的上游服务，所有上游 URL 来自管理员配置而非用户输入
---
 .github/workflows/security-scan.yml | 2 +-
 backend/.gosec.yaml                 | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)
 create mode 100644 backend/.gosec.yaml

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 05dd1d1a..781446dd 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -32,7 +32,7 @@ jobs:
         working-directory: backend
         run: |
           go install github.com/securego/gosec/v2/cmd/gosec@latest
-          gosec -severity high -confidence high ./...
+          gosec -conf .gosec.yaml -severity high -confidence high ./...
 
   frontend-security:
     runs-on: ubuntu-latest
diff --git a/backend/.gosec.yaml b/backend/.gosec.yaml
new file mode 100644
index 00000000..8d27715a
--- /dev/null
+++ b/backend/.gosec.yaml
@@ -0,0 +1,7 @@
+global:
+  # Exclude G704 (SSRF via taint analysis) - this is an API gateway platform
+  # that by design proxies requests to configurable upstream services.
+  # All upstream URLs are sourced from admin-configured settings or known
+  # third-party API endpoints, not from end-user input.
+  exclude:
+    - G704