oadmin/sub2api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

chore: 配置 gosec 排除规则

Browse Source 
- 新增 backend/.gosec.yaml 配置文件，排除 G704 (SSRF) 检查
- 更新 security-scan.yml workflow，使用 gosec 配置文件
- 原因：作为 API 网关平台，需要代理请求到配置的上游服务，所有上游 URL 来自管理员配置而非用户输入
This commit is contained in:
wucm667
2026-02-13 10:48:33 +08:00
parent c7b42148a5
commit 5f4eb9f9d0
2 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/security-scan.yml vendored
View File

@@ -32,7 +32,7 @@ jobs:
working-directory: backend working-directory: backend
run: | run: |
go install github.com/securego/gosec/v2/cmd/gosec@latest go install github.com/securego/gosec/v2/cmd/gosec@latest
gosec -severity high -confidence high ./... gosec -conf .gosec.yaml -severity high -confidence high ./...
frontend-security: frontend-security:
runs-on: ubuntu-latest runs-on: ubuntu-latest

7
backend/.gosec.yaml Normal file
View File

@@ -0,0 +1,7 @@
global:
# Exclude G704 (SSRF via taint analysis) - this is an API gateway platform
# that by design proxies requests to configurable upstream services.
# All upstream URLs are sourced from admin-configured settings or known
# third-party API endpoints, not from end-user input.
exclude:
- G704