Linter: gosec, Rule: G111 - Potential directory traversal. Should we enable it?

[zak-pawel]

Use Case

This issue starts discussion about enabling:

• linter: gosec - Inspects source code for security problems by scanning the Go AST.
• rule: G111 - Potential directory traversal

Rule is mapped to CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

Expected behavior

Decision if rule should be enabled or not.

Actual behavior

For this rule no findings were found in current code.

Additional info

For this rule additional configuration can be provided:

      G111:
        # Regexp pattern to find potential directory traversal.
        # Default: "http\\.Dir\\(\"\\/\"\\)|http\\.Dir\\('\\/'\\)"
        pattern: "custom\\.Dir\\(\\)"

[powersj]

+1