Linter: gosec, Rule: G107 - Url provided to HTTP request as taint input. Should we enable it?

[zak-pawel]

Use Case

This issue starts discussion about enabling:

• linter: gosec - Inspects source code for security problems by scanning the Go AST.
• rule: G107 - Url provided to HTTP request as taint input

Rule is mapped to CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
.

Expected behavior

Decision if rule should be enabled or not.

Actual behavior

For this rule following finding was found in current code:

tools/license_checker/package.go:34:19  gosec  G107: Potential HTTP request made with variable url

Additional info

For this rule no additional configuration can be provided.

[powersj]

+1

[zak-pawel]

More info: https://securego.io/docs/rules/g107.html