Linter: gosec, Rule: G102 - Bind to all interfaces. Should we enable it?

[zak-pawel]

Use Case

This issue starts discussion about enabling:

• linter: gosec - Inspects source code for security problems by scanning the Go AST.
• rule: G102 - Bind to all interfaces

Rule is mapped to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Expected behavior

Decision if rule should be enabled or not.

Actual behavior

For this rule following findings were found in current code:

plugins/common/proxy/socks5_test.go:23:12                    gosec  G102: Binds to all network interfaces
plugins/inputs/kafka_consumer/kafka_consumer_test.go:595:19  gosec  G102: Binds to all network interfaces
plugins/inputs/x509_cert/x509_cert_test.go:86:15             gosec  G102: Binds to all network interfaces

All of them are in tests (can be muted by //#nosec comment). But maybe it is worth to enable it to avoid such bindings in production code?

Additional info

For this rule no additional configuration can be provided.

[Hipska]

Could we fix the tests to not listen to all interfaces?

[powersj]

I think #12923 should do it, no?

This one sounds worth adding - if only to keep our tests consistent as well